[
https://issues.apache.org/jira/browse/WICKET-7190?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105626#comment-18105626
]
ASF subversion and git services commented on WICKET-7190:
---------------------------------------------------------
Commit a1864aeaf6687eb1bcade8c8b08a588b9ecdb6ab in wicket's branch
refs/heads/master from Emond Papegaaij
[ https://gitbox.apache.org/repos/asf?p=wicket.git;h=a1864aeaf6 ]
WICKET-7190 State the page store trust boundary on the crypt API
The redesigned crypt classes document what they guarantee, but not the limits
of that guarantee. Both points were made in the javadoc of the ICrypter
implementations this branch removes, and until now survived only in
StoreSettings#setEncrypted, the user guide and SECURITY.md - none of which a
reader lands on when they open CryptingPageStore or implement ICryptScheme.
Record on CryptingPageStore that the session-held key protects the stored
pages against a party who can read or write the underlying store, but not
against one who already controls the session, so the store is still trusted
storage. Note on ICryptScheme that a custom scheme returning unverified
plaintext instead of null removes the tamper detection callers rely on, and
point both at SECURITY.md.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
> Unified cryptography API
> ------------------------
>
> Key: WICKET-7190
> URL: https://issues.apache.org/jira/browse/WICKET-7190
> Project: Wicket
> Issue Type: New Feature
> Components: wicket-core
> Reporter: Emond Papegaaij
> Assignee: Emond Papegaaij
> Priority: Major
> Fix For: 11.0.0
>
>
> The current cryptography API in Wicket is split over {{ICrypt}} and
> {{ICrypter}}. Both APIs serve a similar purpose but for different subsystems.
> The goal is to unify these APIs and to allow the implementation of more
> modern ciphers, with AEAD support. Also, the documentation on this API and
> its implementations must be improved, clearly stating what it does and what
> it does not deliver.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
