How to update the Encryption Key

[DavidGarciaCat]

Hello,

I want to update the encryption key I am using, however there are too much details that I want to keep and they are encrypted (of course).

How can I decrypt all details, and then encrypt them using the new Key?

Thanks,

[vmelnik-ukraine]

Hi @DavidGarciaCat . This bundle is pretty old and doesn't have such a feature out of the box. There are at least a few directions you can look at:

1. Custom Encryptor

One possible solution for you is to register your own encryptor. You can extend the default one which is VMelnik\DoctrineEncryptBundle\Encryptors\AES256Encryptor. Here, in your encryptor you'll need to add a way to change the secret key in runtime, something like this:

class CustomAES256Encryptor extends AES256Encryptor
{
    /**
     * {@inheritdoc}
     */
    public function __construct($key)
    {
        $this->setSecretKey($key);
    }

    /**
     * @param string $key
     */
    public function setSecretKey($key)
    {
        $this->secretKey = md5($key);
        $this->initializationVector = mcrypt_create_iv(
            mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB),
            MCRYPT_RAND
        );
    }

    /**
     * @return string
     */
    public function getSecretKey()
    {
        return $this->secretKey;
    }
}

After that you'll have to register it as a service and use it in your config:

vmelnik_doctrine_encrypt:
    encryptor_service: <id of your encryptor>

And then you'll have to use some kind of migration. For example, you may create a cursor and iterate through your objects that have to be updated:

$encryptor = // get your service
$em = // get an entity manager
$cursor  = // get cursor
$plainObjects = [];
$oldSecretKey = $encryptor->getSecretKey();
$newSecretKey = // your new secret key

foreach ($cursor as $object) {
    // here postLoad will fire and the object will be decrypted/plain
    $plainObjects[] = $object;
    if (count($plainObjects) >= $batch) {
        // set your new secret key
        $encryptor->setSecretKey($newSecretKey);
        foreach ($plainObjects as $plainObj) {
            $em->persist($plainObj);
        }
        $em->flush();
       // set the old secret key to process the next batch of objects
       $encryptor->setSecretKey($oldSecretKey);
    }
}

2. Custom event subscriber

Another approach is to extend the default subscriber and then use your version replacing the default one via a compiler pass and definitions. You can rewrite persist/update methods to use the new secret key you want to migrate to, but still use the old one for postLoad.

3. MySQL

I'm not sure if it worked for you, but MySQL has AES functions. It may be an alternative solution with one complex query.

It seems like you'll have to enable the maintenance mode, then update your code base, run migration, change the key to the new one in your config, switch to the normal mode again.

Don't forget to make a backup before you start experimenting :)

[DavidGarciaCat]

Hello @vmelnik-ukraine thanks for your quick response. Excellent, given the bundle does not provide this functionality, and based on your comments, I will try to implement this feature following your suggestions. Regards,