736573 - Encrypt in-app payment secrets with HSM

Status: RESOLVED WONTFIX

(addons.mozilla.org Graveyard :: Developer Pages, defect, P1)

Description

[Kumar McMillan [:kumar]]

For an app to talk securely to the marketplace it needs to encrypt all requests with its secret (provided on sign-up in bug 703093)

Instead of storing the secrets directly in the database we can store an encrypted secret in the database using an HSM key. This will come in two parts:

- when a secret is generated on the management pages, encrypt/decrypt
- when an app makes a payment request, decrypt its secret to verify the request

Comment 1

[Kumar McMillan [:kumar]]

As part of this development, existing secrets should be disabled. That is, the app develops will need to regenerate them.

Comment 2

[Kumar McMillan [:kumar]]

we are currently discussing whether or not it's ok to encrypt / decrypt with a key on disk rather than using the HSM.

Comment 3

[Kumar McMillan [:kumar]]

given the threat model around in-app payment secrets we decided that using the HSM is not necessary. Encrypt/decrypt moved to bug 742751