Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement local encryption #73

Merged
merged 16 commits into from
Oct 31, 2022
Merged

Implement local encryption #73

merged 16 commits into from
Oct 31, 2022

Conversation

gferon
Copy link
Collaborator

@gferon gferon commented Oct 5, 2022

Implement encryption of the values stored in the sled::Db which is in theory the last missing feature in presage 🥳

This breaks again the compatibility of previous sled stores (sorry 😢) since I also took the opportunity to refactor the code and introduce this change with more removed code than added (!)

EDIT: will not merge this before I come up with some sort of schema migration system (which shouldn't be too hard, but will take a bit of extra time)

@gferon gferon added the enhancement New feature or request label Oct 5, 2022
@gferon gferon mentioned this pull request Oct 6, 2022
3 tasks
@Schmiddiii
Copy link
Contributor

Schmiddiii commented Oct 6, 2022

Overall this looks good to me, but I have some issues I am currently unsure about (and don't know if they even apply):

  • The tree-names are not encrypted, it is therefore possible to extract all threads (including contacted UUIDs and GroupMasterKeys) from an encrypted DB
  • Messages and Contacts are currently stored unencrypted (as far as I understand the code, only self.[get,insert] encrypts, but these are directly executed on the self.db)
  • Keys are not encrypted. I am not sure that is a huge security-risk, but that should be thought about.
  • There is a big warning sign in crates.io but I think this should be ok.

Maybe my understanding of the code is also wrong.

src/store/sled.rs Show resolved Hide resolved
src/store/sled.rs Outdated Show resolved Hide resolved
@gferon
Copy link
Collaborator Author

gferon commented Oct 31, 2022

There is a big warning sign in crates.io but I think this should be ok.

Just to address this comment, this is exactly used as intended (and is also used in a similar fashion in the matrix-sdk). presage is not a final application but also a building block.

@gferon gferon enabled auto-merge (squash) October 31, 2022 22:06
@gferon gferon disabled auto-merge October 31, 2022 22:07
@gferon gferon merged commit 3367466 into main Oct 31, 2022
@gferon gferon deleted the sled-encryption branch October 31, 2022 22:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants