globaleaks/GlobaLeaks — Issue #112: GlobaLeaks encrypted storage
Author: fpietrosanti
Created: 2011-11-20 12:05:34+00:00
State: open
Labels: Feature, Security

In order to protect the GlobaLeaks site data, in case of non-live compromise (for example server seizure), it's required to provide an option to encrypt all the database and file data.

Database is based on sqlite and technically it can be encrypted with http://sqlcipher.net .
Files can be encrypted with PGP, generating a Private/Public key for the node, at installation time.

The Administrator log-in to admin interface:
- Select Config
- Select Site Security
- Select Enable Site Encryption
- Select a Password twice
- Click Submit

A security procedure it's triggered:
- A PGP private/publick key pair is generated, protected with the Site password
- A passphrase for db-encryption is generated
- The db-encryption password it's encrypted with the site PGP Public key and stored (in another db or file?)

The administrator it's required to make a node restart, to activate that feature, due to the need to:
- "migrate" database from plain to encrypted format
The restart have to be done from command line, where the Site password can be provided as a command line option, to allow background migration operations.

The administrator can change the Site password from the web interface, or by manually changing the site PGP private key password (operating on raw data).

At GlobaLeaks site startup, GlobaLeaks is not active until the administrator connect to the web interface to unlock the node or unlock it from the command line interface.

If the GlobaLeaks site is "Locked" (the admin still didn't entered the unlock passphrase) the Landing, Submission and Tulip Page will report that node is locked and services cannot be provided until the administrator unlock the node with the site password.