5-improve-encrypted-storage #6

Merged

eelke merged 17 commits from 5-improve-encrypted-storage into main

2026-02-27 17:57:44 +00:00

eelke commented

2026-02-27 17:56:55 +00:00

Owner

Added the use of DEK's for encryption of secrets. Both the KEK's and DEK's are stored in a way that you can have multiple key of which one is active. But the others are still available for decrypting. This allows for implementing key rotation.

eelke added 17 commits 2026-02-27 17:56:57 +00:00

WIP making ClientCreate endpoint eb872a4f44

Reworked code around signing keys have key details much more isolated from the other parts of the program. 0c6f227049

Add some tests cd2ec646fd

Tests voor client api and service 3d73a9914c

Cleanup e0f6f3f8a9

Merge pull request #1 from Eelke76/client-service-and-api ad2e952125

client-service-and-api

Add github job to run tests 72dbc5acbf

Fix library reference 4b493ee28d

Another reference fix c2a2184353

Fix injection of encryption secret 21b53ff5b3

No codecov (AI was over eager) just show the numbers in github. ac08956339

Improve the binary storage format of encrypted secrets. Move the related code from AesGcmHelper into the EncryptionService. 4201d0240d

Support rotation of master key. 644b005f2a

The EncryptionService now loads a set of keys and uses the active one to encrypt and selects key based on keyid during decryption. Introduced EncryptedValue to hold keyId and encrypted data.

(There are no intermeddiate keys yet)

Encrypt realm data with dek which is encrypted with kek. The signing keys are also encrypted with the kek. 650fe99990

Pass Span instead of Memory ccc00d8e80

Improve test coverage 1cd7fb659a

Cleanup d8f6024afd