feat: Encrypt private keys saved on disk and in DB #45

New Issue

AtHeartEngineer · 2025-07-08T08:38:22-04:00

AtHeartEngineer commented

2025-07-08 08:38:22 -04:00

Originally created by @ItalyPaleAle on 6/25/2025

Fixes #580

Implements the design described here: https://github.com/pocket-id/pocket-id/issues/580#issuecomment-2918342289

Adds support for storing private keys in the database
Adds support for encrypting the private keys stored on disk (optional) or in the database (required)
Adds support for running Pocket ID with in-memory only (ephemeral) keys

Adds these new config options:

KEYS_STORAGE, which can be file or database. The default is file.
ENCRYPTION_KEY allows passing a key to use to encrypt keys stored on disk or DB
ENCRYPTION_KEY_FILE is akin to ENCRYPTION_KEY but contains the path to a file with the key to load

When keys are encrypted, they are tied to a specific instance of Pocket ID (identified by the InstanceID internal config setting).

Also note that keys are encrypted with AES-GCM.

*Originally created by @ItalyPaleAle on 6/25/2025* Fixes #580 Implements the design described here: https://github.com/pocket-id/pocket-id/issues/580#issuecomment-2918342289 - Adds support for storing private keys in the database - Adds support for encrypting the private keys stored on disk (optional) or in the database (required) - Adds support for running Pocket ID with in-memory only (ephemeral) keys Adds these new config options: - `KEYS_STORAGE`, which can be `file` or `database`. The default is `file`. - `ENCRYPTION_KEY` allows passing a key to use to encrypt keys stored on disk or DB - `ENCRYPTION_KEY_FILE` is akin to `ENCRYPTION_KEY` but contains the path to a file with the key to load When keys are encrypted, they are tied to a specific instance of Pocket ID (identified by the InstanceID internal config setting). Also note that keys are encrypted with AES-GCM.

AtHeartEngineer closed this issue

2025-07-08 08:38:22 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pocket-id#45