https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34976
--- Comment #6 from David Cook <[email protected]> --- (In reply to Marcel de Rooy from comment #3) > Using one encryption key for whole Koha is obviously more convenient than > carrying a large keychain but is unsafer too. If you get that key, you can > decrypt everything. Agreed. > Interesting question though would be: How would you get one key and not the > others? And underlying, is koha-conf the best place to save them? Easy to > ask, harder to answer. If you would get secrets from some vault, you still > need a token for that, etc. I'm not sure I understand this question. Do you mean from a system perspective or an attacker perspective? If it's the system perspective, you have to store a key id (ie kid). > As David referred to the rotation bug, the management of data encrypted with > which key and what version becomes a bit harder.. Security always has a > price. A bit harder but not super hard. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes. _______________________________________________ Koha-bugs mailing list [email protected] https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-bugs website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
