Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Private key password Encryption - Add ability to change password #447

Closed
Krish1979 opened this issue Aug 29, 2018 · 5 comments
Closed

Private key password Encryption - Add ability to change password #447

Krish1979 opened this issue Aug 29, 2018 · 5 comments
Assignees
Labels
enhancement Non-user code enhancements

Comments

@Krish1979
Copy link
Collaborator

Strategically we will have key management tools integrated onto Tessera

@Krish1979 Krish1979 added the enhancement Non-user code enhancements label Aug 29, 2018
@Krish1979 Krish1979 added this to the October milestone Aug 29, 2018
@prd-fox
Copy link
Contributor

prd-fox commented Sep 11, 2018

Requirements:
Private keys that are protected with a password should be able to have that password changed.

Outstanding questions:

  • What command line parameters to use for specifying a password change?
  • Should this operation update the configuration and then autostart the application, like the new key generation does?

@prd-fox
Copy link
Contributor

prd-fox commented Sep 11, 2018

Answers to above questions:

a)
Use separate CLI options that specify:

  1. The private key file to modify (inline changes will not be supported currently)
  2. Provide the old password (if the key was locked) either directly or in a file
  3. Provide argon options for that override the defaults

--key.pwdupdate.keyfile <filepath> [ --key.pwdupdate.old <oldpass> | --key.pwdupdate.pwdfile <passwordFile> ] [--key.pwdupdate.argon <iterations> <memory> <parallelism> ]

b)
This operation should overwrite the old key file as the only destructive operation. Updating the configuration with the new password (either the inline password list or the password file) is to be left to the end user.

@melowe
Copy link
Contributor

melowe commented Sep 12, 2018

The update part can be a single flag and the same options can be used .

--update-passwords or whatever the action is.. 

@prd-fox
Copy link
Contributor

prd-fox commented Sep 12, 2018

Using:

--keys.passwordFile
--keys.passwords
--keys.keyData.privateKeyPath
--keys.keyData.config.data.aopts.algorithm
--keys.keyData.config.data.aopts.iterations
--keys.keyData.config.data.aopts.memory
--keys.keyData.config.data.aopts.parallelism

Although they are longer and potentially less clear, they are already defined properties that can be interpreted in the context of updating passwords (instead of the normal case of overriding the configuration file).

@prd-fox
Copy link
Contributor

prd-fox commented Sep 18, 2018

Implemented and the wiki updated.

@prd-fox prd-fox closed this as completed Sep 18, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement Non-user code enhancements
Projects
None yet
Development

No branches or pull requests

3 participants