ActiveRecord::Encryption; Stop Hackers from...
summary
GitHub adopts ActiveRecord::Encryption, implements a custom key provider that reads semicolon‑delimited base keying material from Vault, derives AES‑GCM‑256 keys salted by table and column plus current year to reduce nonce exhaustion, and monkey‑patches to a monkey‑patched encrypts API that only encrypts one column per call. A reusable transition migrates plain text and legacy encrypted rows; rollout uses feature flags and batches. Deterministic encryption is disabled; encrypted columns grow from about 5 to 15 in the first week after rollout.
AI-written summary · about
chapters (9)
- 0:00ActiveRecord::Encryption intro
- 2:27Encrypting database columns
- 6:43Migrating encryption strategy
- 10:35Custom key provider
- 16:41Upgrading records
- 21:33Rollouts and feature flags
- 25:43Disabling compression
- 26:04Key takeaways
- 27:10Q&A
related talks
34mEncrypted Credentials on Rails 5.2: Secrets to Success
10mEncryption Pitfalls and Workarounds
29mData encryption made easy
59mDatabase Encryption in a GDPR World
34mWhy your encrypted Database isn't secure: practical attacks against encrypted OSS databases
23mEncrypted Search Party
48mColumn encryption solutions and ideas
51mKeynote: Data is a new security boundary