Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: hardware security module's support #2671

Merged
merged 32 commits into from
Nov 11, 2024
Merged

feat: hardware security module's support #2671

merged 32 commits into from
Nov 11, 2024

Conversation

DanielHougaard
Copy link
Contributor

@DanielHougaard DanielHougaard commented Oct 31, 2024

Description 📣

This PR introduces hardware security module's support. It works as wrapper around any PKCS11 library, and allows for more secure cryptographic operations such as encryption, decryption, and randomness generation.

The implementation uses a key-wrapping mechanism, so it never directly uses the HSM primary encryption key.

Currently it supports recovery, but we need to iron out if this is actually behavior we want to allow. cc @maidul98

Type ✨

  • Bug fix
  • New feature
  • Improvement
  • Breaking change
  • Documentation

Tests 🛠️

# Here's some code block to paste some code snippets

Copy link
Member

@akhilmhdh akhilmhdh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pending: Application testing and need to read about HSM slot mechanism more

backend/Dockerfile Show resolved Hide resolved
backend/src/lib/config/env.ts Outdated Show resolved Hide resolved
backend/src/main.ts Outdated Show resolved Hide resolved
backend/src/main.ts Show resolved Hide resolved
backend/src/services/kms/kms-service.ts Outdated Show resolved Hide resolved
backend/src/services/kms/kms-service.ts Show resolved Hide resolved
backend/src/services/super-admin/super-admin-service.ts Outdated Show resolved Hide resolved
frontend/src/hooks/useFileDownload.tsx Outdated Show resolved Hide resolved
package.json Show resolved Hide resolved
backend/src/@types/fastify.d.ts Show resolved Hide resolved
backend/src/server/routes/v1/admin-router.ts Outdated Show resolved Hide resolved
backend/src/server/routes/v1/admin-router.ts Outdated Show resolved Hide resolved
backend/src/services/hsm/hsm-service.ts Outdated Show resolved Hide resolved
backend/src/services/hsm/hsm-service.ts Outdated Show resolved Hide resolved
backend/src/services/hsm/hsm-service.ts Outdated Show resolved Hide resolved
backend/src/services/hsm/hsm-service.ts Outdated Show resolved Hide resolved
backend/src/services/hsm/hsm-service.ts Outdated Show resolved Hide resolved
backend/src/services/hsm/hsm-service.ts Outdated Show resolved Hide resolved
Copy link

gitguardian bot commented Nov 8, 2024

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request
GitGuardian id GitGuardian status Secret Commit Filename
14456465 Triggered Generic High Entropy Secret 395b3d9 backend/src/ee/services/hsm/hsm-service.ts View secret
🛠 Guidelines to remediate hardcoded secrets
  1. Understand the implications of revoking this secret by investigating where it is used in your code.
  2. Replace and store your secret safely. Learn here the best practices.
  3. Revoke and rotate this secret.
  4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider


🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

backend/src/services/kms/kms-service.ts Show resolved Hide resolved
backend/src/ee/services/hsm/hsm-service.ts Outdated Show resolved Hide resolved
backend/src/ee/services/hsm/hsm-service.ts Outdated Show resolved Hide resolved
backend/src/ee/services/hsm/hsm-service.ts Show resolved Hide resolved
dangtony98
dangtony98 previously approved these changes Nov 11, 2024
@DanielHougaard DanielHougaard requested review from dangtony98 and akhilmhdh and removed request for akhilmhdh November 11, 2024 18:00
akhilmhdh
akhilmhdh previously approved these changes Nov 11, 2024
@maidul98 maidul98 merged commit 17d5e4b into main Nov 11, 2024
7 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants