Security: Static salt in encryption module weakens security #3

New issue

Closed

opened 2026-03-10 03:45:38 +00:00 by Mark · 1 comment

Mark commented

2026-03-10 03:45:38 +00:00

Owner

Issue

The encryption service uses a static salt (devforge-static-salt) which reduces security for derived keys.

Location

services/api/app/services/encryption.py:48

Current Implementation

salt=b"devforge-static-salt",  # Static salt for deterministic key derivation

Risk

Same password always produces same key
Vulnerable to precomputed attacks if encryption key is compromised
Defeats purpose of using PBKDF2

Proposed Solution

Use a unique salt per encryption operation (stored with ciphertext)
Or use a proper key management system

Acceptance Criteria

Replace static salt with random per-operation salt
Store salt alongside encrypted data
Backward compatibility for existing encrypted data
Add tests for encryption/decryption

Priority: High
Type: Security

## Issue The encryption service uses a static salt (`devforge-static-salt`) which reduces security for derived keys. ## Location - `services/api/app/services/encryption.py:48` ## Current Implementation ```python salt=b"devforge-static-salt", # Static salt for deterministic key derivation ``` ## Risk - Same password always produces same key - Vulnerable to precomputed attacks if encryption key is compromised - Defeats purpose of using PBKDF2 ## Proposed Solution 1. Use a unique salt per encryption operation (stored with ciphertext) 2. Or use a proper key management system ## Acceptance Criteria - [ ] Replace static salt with random per-operation salt - [ ] Store salt alongside encrypted data - [ ] Backward compatibility for existing encrypted data - [ ] Add tests for encryption/decryption **Priority:** High **Type:** Security

Mark commented

2026-05-11 20:14:12 +00:00

Author

Owner

Security architecture change — requires schema migration for per-record salt storage. Not a quick fix.