MyZapp encrypts sensitive data at rest: secret configuration settings, the secret store, two-factor secrets, Outpost data, the instance private key and, when file encryption is enabled, uploaded files. The keys that encrypt them are kept in the instance's key file, managed by the server operator.
The Encryption keys screen (/configuration/encryption, administrators), reached from Configuration, shows where encryption stands after a key change.
What the screen shows
- Active key: the key that encrypts new values.
- Keys: for each key in the file, the number of values still encrypted with it, and its state:
- Active: the key in service;
- Still in use: do not remove: some data still depends on it; removing it would make that data unreadable;
- Can be removed from the key file: no data uses it any more.
- To re-encrypt, by data: the detail by type of data.
The application never removes a key itself: the operator removes it from the file once the screen shows zero.
Only the data of enabled modules is counted: a disabled module that kept encrypted data must be enabled again, and its data re-encrypted, before a key is removed.
Change the key
- The operator adds a new key to the key file, makes it active, then restarts the application. New values are encrypted with it right away; older ones stay readable.
- On this screen, click Re-encrypt with the active key. The re-encryption runs in the background; reload the page to follow the counters. Run history opens the scheduled job's log.
- When the old key shows Can be removed from the key file, the operator can remove it from the file.
Accounts using two-factor authentication keep working before, during and after the re-encryption.
If a counter does not go down
A value that cannot be decrypted (altered value, or key already removed from the file) is not re-encrypted: it stays counted and the screen says so. The application log tells which data is concerned, without ever showing its content. As long as a counter is not zero, do not remove the matching key.
Changing the active key, and the start and end of each re-encryption, are recorded in the audit log.