search

mlavin / django-all-access

django-all-access is a reusable application for user registration and authentication from OAuth 1.0 and OAuth 2.0 providers such as Twitter and Facebook.
http://readthedocs.org/docs/django-all-access/
BSD 2-Clause "Simplified" License
60 stars 29 forks source link

Secret Key Rotation #22

Open mlavin opened 12 years ago

mlavin commented 12 years ago

If the secret key changes then the encrypted data will be lost. There should be a way to rotate the key with minimal work or problems which might cause downtime.

mlavin commented 9 years ago

The cryptography has support for symmetric encryption with key rotation via Fernet: https://cryptography.io/en/latest/fernet/ Migrating the existing field might be tricky but probably worthwhile.