[GH-ISSUE #79] Allow master key rotation #26

New issue

Open

opened 2026-02-28 01:16:53 +03:00 by kerem · 0 comments

kerem commented

2026-02-28 01:16:53 +03:00

Owner

Originally created by @therealpaulgg on GitHub (Feb 22, 2026).
Original GitHub issue: https://github.com/therealpaulgg/ssh-sync/issues/79

There's a chance that master keys are not secure now due to the store now and decrypt later attack. We should enable users to be able to migrate their master keys.

The main thing to note is that the master key is the same value on each and every machine the user has in their control. There is no straightforward way to update all of these files at the same time.

Proposed scheme:

Assume the user has several machines (A, B, C, etc.) Any of these machines should be considered trusted.

One machine should be able to upload the master key to the server, stored in an encrypted fashion, to be downloaded later by the other clients.

We actually have each client's public key, so it should be possible for one machine to start a "migration" by doing the following:

Generate new AES key
Encrypt that AES key n times for each machine that exists, storing n copies of the master key on the server (each copy is encrypted with that n machine's public key)
Machines can at their own leisure download this new master key

We'll need to update the database to store a new migrated master key column. Ideally this is not stored in the database long term, so maybe it would be useful to delete the data after a certain time period.

At minimum hybrid post quantum crypto should be implemented before this point so each machine that downloads can keep that key safe.

Originally created by @therealpaulgg on GitHub (Feb 22, 2026). Original GitHub issue: https://github.com/therealpaulgg/ssh-sync/issues/79 There's a chance that master keys are not secure now due to the store now and decrypt later attack. We should enable users to be able to migrate their master keys. The main thing to note is that the master key is the same value on each and every machine the user has in their control. There is no straightforward way to update all of these files at the same time. Proposed scheme: Assume the user has several machines (A, B, C, etc.) Any of these machines should be considered trusted. One machine should be able to upload the master key to the server, stored in an encrypted fashion, to be downloaded later by the other clients. We actually have each client's public key, so it should be possible for one machine to start a "migration" by doing the following: 1. Generate new AES key 2. Encrypt that AES key n times for each machine that exists, storing n copies of the master key on the server (each copy is encrypted with that n machine's public key) 3. Machines can at their own leisure download this new master key We'll need to update the database to store a new migrated master key column. Ideally this is not stored in the database long term, so maybe it would be useful to delete the data after a certain time period. At minimum hybrid post quantum crypto should be implemented before this point so each machine that downloads can keep that key safe.

No labels

ai-generated

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/ssh-sync#26

No description provided.

Rows
Columns