prevent deprecation notice in PHP 8.0 and above

v0.30b2

prevent deprecation notice in PHP 8.0 and above

specify columns on insert to be more robust regarding schema changes

v0.30b1

specify columns on insert to be more robust regarding schema changes

increased PBKDF2 iteration count for v00 encryption from 10000 to 512000

This release increases the PBKDF2 iteration count for the additional password-based v00 encryption from 10.000 (which is the minimal NIST recommendation [1]) to 512.000 (which is even higher than the OWASP recommendation [2]). To be backwards compatible for now, password-protected secrets with the lower iteration count can be decrypted as well.

[1] https://pages.nist.gov/800-63-3/sp800-63b.html
[2] https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

introduce the support for configuration via environment variables

v0.29b0

introduce the support for configuration via environment variables

updated jQuery and fixed typo

0.28b0

updated version and copyright year

introduced IMPRINT_TEXT option Edit

0.27b0

HTML-escape IMPRINT_TEXT to prevent the admin from breaking the HTML …

introduced JUMBO_SECRETS option

0.26b0

support jumbo secrets in local encryption

improved and fixed key rollover support and the README

This new version introduces a major change to the database as the primary key of the secrets table is extended with the keyid a fingerprint belongs to. This is necessary so that the database supports proper key rollovers without fingerprint collisions between keys. The following steps describe how to properly update an existing database:

1. Download the public key of your instance:

wget -O "./secrets.pub" "https://example.com/pub?plain"

2. Generate the hexadecimally encoded public key keyid:

openssl rsa -pubin -in "./secrets.pub" -pubout -outform DER 2>/dev/null |
openssl dgst -sha256 -binary |
xxd -p |
tr -d "\n" &&
echo

3. Add the new keyid column to the existing database table:

ALTER TABLE secrets ADD COLUMN keyid VARCHAR(64) FIRST;

4. Fill the database with the keyid from step 2:

# setting time=time prevents the timestamps from being updated
UPDATE secrets SET time=time, keyid='<PUBLIC KEY KEYID>';

5. Change the primary key constraint of the existing database table:

ALTER TABLE secrets DROP PRIMARY KEY, ADD PRIMARY KEY (keyid, fingerprint);

creating secret sharing links and downloading the public key is now possible with only RSA public keys set as RSA_PRIVATE_KEYS

0.24b0

creating secret sharing links and downloading the public key is now p…

fixed read-only mode, introduced share-only mode, introduced human-readable public key download 403 response codes on errors

0.23b0

fixed read-only mode, introduced share-only mode, introduced human-re…