André Pinho
Rank: #580
288Views
7Comments
Solved
[CryptoAPI] Safe to save Crypto Key to Site properties?
Question
Component
Forge
CryptoAPI
Forge component by Ricardo Silva
34
Published on 03 Mar 2019

Hi All,

Is saving a cryptographic key or any key like API keys to site properties good/safe practice?
I am using this key to encrypt and decrypt data stored in the DB...

I noticed the CryptoAPI demo (in forge), saved the AES_SaveKey to a site property... 

0
0
on 2019-01-30
Copy link to comment
Ricardo Silva
Rank: #0
Solution

Hello André,

Security is always relative.

Using SaveKey will encrypt the key with the environment's unique 128 bit symmetric key. So even if anyone gains access to the value in the Site Property they'd need to also gain access to the file system of your server to properly decrypt the contents.

I would say it's a safe enough approach for most use-cases.

0
0
on 2019-01-30
Copy link to comment
Antonio Braz
Rank: #4058

Ricardo Silva wrote:

Hello André,

Security is always relative.

Using SaveKey will encrypt the key with the environment's unique 128 bit symmetric key. So even if anyone gains access to the value in the Site Property they'd need to also gain access to the file system of your server to properly decrypt the contents.

I would say it's a safe enough approach for most use-cases.


Hi Ricardo,

does this mean that when using the Default Mode (Environment) of AES_SaveKey this will use the key in Private.Key file of the platform to encrypt the Generated Key of AES_NewKey. This file is unique by environment? Unique also in Outsystems Paas?


Regards

António Braz

0
0
on 2019-03-07
Copy link to comment
André Pinho
Rank: #580

Hi Ricardo, makes sense, thanks.
Would you then recommend to encrypt API keys?

0
0
on 2019-01-30
Copy link to comment
Ricardo Silva
Rank: #0

Hi André,


Sorry for the late reply, but yes, of course I would.


You can use the pattern shown in Crypto API Demo where you generate a key, save it to a site property and encrypt the api keys with that key.

0
0
on 2019-02-01
Copy link to comment
Ricardo Silva
Rank: #0

Hello António,

That is correct. SaveKey will encrypt the key being saved with the environment's private key.

This key is generated once per installation and is unique per environment in On-Premise environments and in the OutSystems Enterprise Cloud.

0
0
on 2019-03-07
Copy link to comment
Ricardo Pedroso
Rank: #9374

Hello Ricardo,

I'll use this post, as my question comes upon this implementation. I'm following exactly what you have in your demo app (as picture above by André). My question is, we still end-up with two "plain text" site properties within our module (ProtectedSiteProperty and SavedKey). My questions is, how is this better than just storing the key in plain text manually wihtout using the save key action? I belive there's extra security following your implementation, I'm just not fully understanding it.

Thanks for your help!

Ricardo Pedroso

0
0
on 4th Jan
Copy link to comment
João Barata
Staff
Rank: #63

Hi,

The example above is taking care of 2 things and that is why you end up with 2 site properties.

The first one, SavedKey, is used to safely store the result of the NewKey.
You generate a new private key and then encrypt it so that it can be safely stored in site property to be used in the future.

The other one, ProtectedSiteProperty is the actual encrypted value of your site property you want to save.
This value is encrypted using the key that is stored on the SavedKey.

That is the reason you end up with 2 site properties. You don't need to store the SavedKey in a site property though.
You could use the same key to encrypt other site properties and values, however, the more you share the same key, the higher the risk once the key gets compromised.

Hope this helps,

0
0
on 4th Jan
Copy link to comment