Alex/kaido-core
SHA256
Watch
1
0
Fork
You've already forked kaido-core
 0
Code Issues 10 Pull requests 1 Releases Activity Actions

Encrypt secrets at rest #89

New issue
Closed
opened 2026-11-08 13:31:00 +01:00 by Alex · 1 comment
Alex commented 2026-11-08 13:31:00 +01:00
Owner

Problem

  • Secrets are stored unencrypted in the configuration database.

Impact

  • Anyone with a copy of the database or a backup can read them.

Proposed change

  • Encrypt secrets at rest and mask them only for display.
  • Keep revert working for encrypted values.

Validation

  • Tests for storage, display, revert and restore.
## Problem - Secrets are stored unencrypted in the configuration database. ## Impact - Anyone with a copy of the database or a backup can read them. ## Proposed change - Encrypt secrets at rest and mask them only for display. - Keep revert working for encrypted values. ## Validation - Tests for storage, display, revert and restore.
Alex commented 2026-11-08 14:00:10 +01:00
Author
Owner

Entschieden in ADR 0021 (ccac911c): Passwörter, die nur geprüft werden, sind bereits gehasht. Die übrigen Secrets, die der Router im Klartext braucht, bleiben im Klartext in config.db. Verschlüsselte Backups sind für später vorgesehen: #90.

Entschieden in ADR 0021 (ccac911c): Passwörter, die nur geprüft werden, sind bereits gehasht. Die übrigen Secrets, die der Router im Klartext braucht, bleiben im Klartext in config.db. Verschlüsselte Backups sind für später vorgesehen: #90.
Alex closed this issue 2026-11-08 14:00:10 +01:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
119-example-firstboot
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Alex/kaido-core#89
No description provided.