With the completion of T145915, we should create a new maintenance script (or simply add an option to the existing UpdateTOTPSecretsToEncryptedFormat.php) that migrates encrypted data within the oathauth_devices table from one OATHSecretKey value to another. Various OATHSecretKey values will likely be accidentally or intentionally leaked or compromised and there is currently no good option to efficiently support switching to a new key value when such incidents occur.
Description
Description
Details
Details
Related Changes in Gerrit:
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Add a maintenance script to re-encrypt secrets | mediawiki/extensions/OATHAuth | master | +184 -26 |
Related Objects
Related Objects
Event Timeline
Comment Actions
I guess the script just needs to read the encrypted rows, decrypt with $old key, encrypt with $new key, and save back to the database.
Probably a little thought of how we want to take those as parameters, or whether to use $wgOATHSecretKey for one of them...
Is it worth allowing $wgOATHSecretKey to be an array... And if decryption fails (like during actions on the site whilte migration is happening), use the other key... Or is that just overcomplicating something that shouldn't take too long (well, depending on the number of users)...
Comment Actions
Change #1256465 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/OATHAuth@master] WIP: Add script to re-encrypt secrets
Comment Actions
Change #1256465 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@master] Add a maintenance script to re-encrypt secrets