Make session storage use proper encryption keys #1444

New issue

Open

opened 2025-12-28 17:23:01 +00:00 by sami · 0 comments

sami commented

2025-12-28 17:23:01 +00:00

Owner

Originally created by @roman-khimov on GitHub (Jun 25, 2025).

Expected Behavior

Private key is not used as a symmetric encryption key.

Current Behavior

#1255 did exactly that.

Possible Solution

We're talking sessions here, so there is an ephemeral key pair, public key can be used along with proper salt for ECDH to generate per-token encryption key.

Steps to Reproduce (for bugs)

Look at the code.

Context

#1255, #3425.

Regression

Not exactly.

Your Environment

Version used: 0.47.1

Originally created by @roman-khimov on GitHub (Jun 25, 2025). ## Expected Behavior Private key is not used as a symmetric encryption key. ## Current Behavior #1255 did exactly that. ## Possible Solution We're talking sessions here, so there is an ephemeral key pair, public key can be used along with proper salt for ECDH to generate per-token encryption key. ## Steps to Reproduce (for bugs) Look at the code. ## Context #1255, #3425. ## Regression Not exactly. ## Your Environment * Version used: 0.47.1