Skip to content

Add PGP encryption #3

@mdugas

Description

@mdugas

Is your feature request related to a problem? Please describe.
When a user pulls a configuration file, it is only protected by the connection security (at most TLS 1.3 as of this writing). With corporate environments where SSL traffic is inspected we know the config file will be retrieved and scanned by the corporate proxy. With regular users, this bring to attention the problem of Man-in-the-Middle attacks (MitM) where a threat actor successfully injects himself between the target and the server to snoop on the conversation. Since this configuration file is meant for the specific user and is used to provide Authentication, Authorization and Accountability (AAA) to the underlying VPN system it is of the utmost importance that more vulnerable users have additional means to protect themselves against MitM attacks.

Describe the solution you'd like

  1. The system needs to be able to transmit the configuration file in a way that the intended user is the only party able to access the file and use it.
  2. The system needs to ensure the method used does not involve transmitting a secret a way that is also vulnerable to MitM attacks.

Additional context
Proposed method is to encrypt the configuration file using the client's provided PGP or S/MIME public key before transmission.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions