-
Notifications
You must be signed in to change notification settings - Fork 506
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Password rotation possibility #366
Comments
I’m confused, change on any secret… encryption key or encrypted secret will require you to change the values in the property files… |
@ulisesbocchio Let me rephrase my problem. We are using Jasypt to keep the data encrypted in the DB (Hibernate). So we set a password let's say 123, and we have 10 records in the DB with encrypted value through Jasypt. Now, I want to change the password from 123 to 234, but the existing records in the DB were encrypted with the password 123, correct? So my question was, is there any possibility for password rotation without touching already encrypted values in the DB, or do we need to write a job or so which will do the rest? e.g. get the encrypted data form the DB using an old password, encrypt with a new password, and put back. Hope I was clear now, thanks! |
Ah, the answer is yes, but not for free :) Or all of the above....
You'd figure out the code, but the trick here would be to also "enhance" the private static class KeyedMessage {
public static parse(String value) {
// split incoming msg expecting a char separator like @ or whatever, for instance: `old@uaosdifuosidfu`
return new KeyedMessage(key, message);
}
public String toString() {
return this.key + "@" + this.message;
}
}
private StringEncryptor getDelegate(String key) {
// find own encryptors by key, or if key === null, use default one.
}
@Override
public String encrypt(String message) {
KeyedMessage msg = KeyedMessage.parse(message);
String encrypted = this.getDelegate(msg.getKey()).encrypt(msg.getMessage());
return new KeyedMessage(msg.getKey(), encrypted).toString();
}
@Override
public String decrypt(String encryptedMessage) {
KeyedMessage msg = KeyedMessage.parse(message);
return this.getDelegate(msg).decrypt(msg.getMessage());
} then essentially you can add/remove encryptors to your list via config, and change the encrypted values in the DB at your own pace, so long as you don't remove the encryptor config before you remove the last encrypted password with that encryptor. |
Thanks @ulisesbocchio , I will check the solution and repost it here. |
Hi,
Is there any possibility to change the password but not touch already encrypted values? The requirement is to rotate passwords once in 2 months, and I cannot find a way how to do it without already encrypted data re-encryption. It will be really helpful to have a master password and a secondary password, so we can put them and Jasypt can automatically handle it.
The text was updated successfully, but these errors were encountered: