Cordy/Cairn
2
1
Fork 0
Code Issues 15 Pull requests Projects Releases Packages Wiki Activity Actions

Credential-derived key custody — spike (local/LDAP only) #30

New issue
Open
opened 2026-07-25 17:44:01 +00:00 by Cordy · 0 comments
Cordy commented 2026-07-25 17:44:01 +00:00
Owner
Copy link

Manuel's passwordHash + user-PIN → key model: derive the encryption key from user credentials so it lives only in RAM (zeroed after use) and the backend holds no standing key — a stronger data-processor posture.

Hard constraint (the crux): this works only where the server sees the password —

  • ✅ local auth, LDAP search-then-bind
  • ❌ OIDC (server never sees the IdP password) and WebDAV app-passwords (random per-device secrets); also breaks share links, admin visibility, background access.

It's the E2E trade-off relocated to key derivation: "server never holds a usable key" XOR "transparent decryption for all clients." OpenBao does not solve this (orthogonal). Spike in local/LDAP mode, measure the UX/threat trade honestly, write it into ENCRYPTION-COMPARISON.md. This is the risky half of the weekend prototype.

Manuel's `passwordHash + user-PIN → key` model: derive the encryption key from user credentials so it lives **only in RAM** (zeroed after use) and the backend holds no standing key — a stronger data-processor posture. **Hard constraint (the crux):** this works only where the server sees the password — - ✅ local auth, LDAP search-then-bind - ❌ **OIDC** (server never sees the IdP password) and WebDAV **app-passwords** (random per-device secrets); also breaks share links, admin visibility, background access. It's the E2E trade-off relocated to key derivation: *"server never holds a usable key"* XOR *"transparent decryption for all clients."* OpenBao does **not** solve this (orthogonal). Spike in local/LDAP mode, measure the UX/threat trade honestly, write it into `ENCRYPTION-COMPARISON.md`. This is the risky half of the weekend prototype.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
v0.3.3
v0.3.2
v0.3.1
v0.3.0
v0.2.7
v0.2.6
v0.2.5
v0.2.4
v0.2.3
v0.2.2
v0.2.1
v0.2.0
v0.0.3
v0.0.2
Labels
Clear labels
No items
No labels
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#30
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?