Open
Bug 2068603
Opened 1 day ago
Updated 18 hours ago
SQLite encryption should use profileEncryption KEK instead of sqlite KEK
Categories
(Enterprise Products :: Firefox, enhancement, P3)
Enterprise Products
Firefox
Tracking
(Not tracked)
ASSIGNED
People
(Reporter: nwipper, Assigned: nwipper)
References
Details
Attachments
(1 file)
Lockstore already uses the Felt secret for SQLite encryption. However, it is using the old KEK name "sqlite". Other components that use lockstore and need a KEK that is always unlocked use the newer "profileEncryption" KEK. Before we can migrate away from "sqlite" enterprise needs to, in order:
- create and unlock a "profileEncryption" KEK using the Felt secret
- soft migrate DEKs from "sqlite" to "profileEncryption", so that they are wrapped by both KEKs
Then in MC SQLiteEncryption.cpp can start using profileEncryption, so that enterprise can finish the migration by deleting "sqlite"
|
Assignee | |
Updated•1 day ago
|
Severity: -- → S3
Priority: -- → P3
|
||
Comment 1•1 day ago
|
||
|
|
Assignee | |
Updated•18 hours ago
|
Summary: Create profileEncryption lockstore KEK from Felt secret → SQLite encryption should use profileEncryption KEK instead of sqlite KEK
You need to log in
before you can comment on or make changes to this bug.
Description
•