Support convergent encryption #56
Conversation
Currently, Vault's Transit engine supports key derivation, but vault-rails does not support convergent encryption.
There was a problem hiding this comment.
Thanks for submitting this! And apologies for the delay in response.
I added support for key derivation in #78, and would love to help get this merged and released alongside of that.
We’ve added a CLA process since this PR was opened, which must be accepted before any of the code in this PR can be merged. You can sign the CLA here: https://cla.hashicorp.com/hashicorp/vault-rails?pullRequest=56.
Let me know if you’d like to continue work on this. If not, I’m happy to take over rebasing and merging it after you’ve signed the CLA.
Thanks again!
| # | ||
| # @return [String] | ||
| # the encrypted cipher text | ||
| def encrypt(path, key, plaintext, client = self.client) | ||
| def encrypt(path, key, plaintext, client = self.client, convergent = false) |
There was a problem hiding this comment.
#78 changes the signature of encrypt and decrypt, such that we can refactor this PR to use keyword arguments for the convergent boolean.
| @@ -27,6 +27,11 @@ module Rails | |||
| DEV_WARNING = "[vault-rails] Using in-memory cipher - this is not secure " \ | |||
| "and should never be used in production-like environments!".freeze | |||
|
|
|||
| VAULT_CONVERGENT_ENCRYPTION_CONTEXT = Base64.strict_encode64( | |||
| ENV.fetch('VAULT_CONVERGENT_ENCRYPTION_CONTEXT', 'default-context') | |||
| ).freeze | |||
There was a problem hiding this comment.
Can this be removed in favor of per-attribute contexts in #78?
|
Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement Learn more about why HashiCorp requires a CLA and what the CLA includes Molly Huerster seems not to be a GitHub user. Have you signed the CLA already but the status is still pending? Recheck it. |
|
I'm closing this PR due to lack of CLA and merge conflicts that have accrued since 2018. |
Currently, Vault's Transit engine supports key derivation, but
vault-rails does not support convergent encryption.