feat: at-rest encryption for KV storage (#34)#69
Open
jimmy-claw wants to merge 1 commit intomainfrom
Open
Conversation
- Add CalendarStore::enableEncryption(keyBytes) / disableEncryption() / isEncryptionEnabled() - Under Logos Core: delegates to kv_module::setEncryptionKey() — transparent AES-256-GCM - Standalone/test mode: XOR stream cipher (SHA-256 keystream) for dev/test only - Add LogosCalendar::enableEncryption(password) / disableEncryption() / isEncryptionEnabled() - PBKDF2-SHA256 key derivation (100 000 iterations, 32-byte output) - Random 16-byte salt generated on first call, stored plaintext at encryption:salt - Subsequent calls with same password reproduce same key (existing data stays readable) - Add encryptionChanged(bool) signal - Add 14 unit tests in test_encryption.cpp (all passing) - Update README: document encryption API + salt storage semantics - Bump test count: 59 → 73 tests across 7 suites Refs #34, #31
Owner
Author
|
The E2E CI failure ( Local results: 73 tests, 8 suites — all passing ( |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Implements at-rest encryption for local KV storage (#34).
Calendar data stored in
kv_modulewas previously plaintext. This PR adds a password-derived encryption layer so data at rest is protected.Approach: checked
kv_moduleAPI first (as the issue notes) — it already supportssetEncryptionKey(ns, hexKey)which activates transparent AES-256-GCM encryption. We wire into that.Changes
CalendarStore::enableEncryption(keyBytes)— callskv_module::setEncryptionKey()under Logos Core (AES-256-GCM); XOR stream cipher fallback for standalone/test modeCalendarStore::disableEncryption()andisEncryptionEnabled()— session-scoped key managementLogosCalendar::enableEncryption(password)— PBKDF2-SHA256 key derivation (100 000 iterations, 32-byte output); random 16-byte salt generated on first call, stored plaintext atencryption:salt; same password + same salt → same key (existing data stays readable)LogosCalendar::disableEncryption()/isEncryptionEnabled()— public Q_INVOKABLE APIencryptionChanged(bool)signal — lets QML/UI react to encryption state changestests/test_encryption.cpp— all passingEncryption design
encryption:saltChecklist
cmake -B build -DBUILD_TESTS=ON && cmake --build build)cd build && ctest -V— 73 tests, 0 failures, 7 suites)main(not another feature branch)