From d14fd55641f508aaff536fca98d263774721c3dd Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Thu, 13 Nov 2014 13:11:31 -0400 Subject: add --- doc/todo/privdata_file_split.mdwn | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 doc/todo/privdata_file_split.mdwn (limited to 'doc/todo') diff --git a/doc/todo/privdata_file_split.mdwn b/doc/todo/privdata_file_split.mdwn new file mode 100644 index 00000000..655067c9 --- /dev/null +++ b/doc/todo/privdata_file_split.mdwn @@ -0,0 +1,27 @@ +Currently all the privdata is written into a single encrypted file. + +This makes it more likely that, if multiple people are co-administering +with propellor, they will make conflicting changes to the privdata. +And resulving such a conflict would be pretty tricky. + +This could be improved by splitting up the privdata file, so there's one +encrypted file per item. Conflicting commits would then be less likely, +and even if they happened, it would only be one item in conflict, so +should be eaiser to resolve it. + +Are there privacy concerns with splitting privdata? It would let anyone who +can access the repository but not decrypt it guess more about its +properties. + +They could look at the size of an item and make guesses about eg, the +length of a password. This could be blocked by padding the privdata, but it +would need to be padded before encryption with binary garbage. + +They could also enumerate the various privdata fields. However, this can already +be done by looking at the propellor configuration, so I don't think it's a +problem. + +Finally, an attacker could look at the history of what privdata changed +when. Currently, all an attacker can see is that some change was made to +the privdata file; splitting it up would let them see which fields were +changed when. -- cgit v1.2.3