search

sillsdev / chorus

End-user collaboration library via 3-way xml merging and hg dvcs under the hood
6 stars 26 forks source link

Password Encryption/Decryption will crash LibChorus on Linux .NET6 #298

Open josephmyers opened 1 year ago

josephmyers commented 1 year ago

ServerSettingsModel has the methods EncryptPassword and DecryptPassword. These use System.Security.Cryptography.ProtectedData, which compiles for .NET6 but throws a runtime exception on Linux.

var encryptedData = ProtectedData.Protect(Encoding.Unicode.GetBytes(encryptMe),
        Encoding.Unicode.GetBytes(EntropyValue), DataProtectionScope.CurrentUser);
return Convert.ToBase64String(encryptedData);

No one is currently using this, but if they try it will break. We need a cross-platform password solution, or one that at least adapts to platform-specific calls.

ermshiperete commented 1 year ago

I created a cross-platform SIL.PasswordStore library that we could/should use (nuget package). This is a wrapper around OS functionality.

This would change the way we store the password, so we would no longer put it in the config file and we no longer need EncryptPassword/DecryptPassword methods. How the password is stored and encrypted would be left to the OS.

We could consider a migration path where we read the encrypted password from the config file, decrypt it, store it with SIL.PasswordStore, then delete it from the config file.