Upgrade guide for devise-two-factor with attr_encrypted 3.x doesn't work about devise-two-factor HOT 5 CLOSED

I'm rather confused about this part of the guide.

First of all I can't get it to work with any of the variations above.
I'm now using attr_encryped version 3.0.1 and devise-two-factor 2.2.1, but am coming from attr_encrypted 1.4.0/devise-two-factor 2.1.0.
It worked with:

attr_encrypted :otp_secret, :key  => Rails.application.secrets.p9_2fa_encryption_key,
                              :insecure_mode => true,
                              :mode      => :single_iv_and_salt,
                              :algorithm => 'aes-256-cbc'   

Besides, have you any guidance on how to migrate encrypted data using attr_encrypted 1.4.0/devise-two-factor 2.1.0 to the latest versions?
Using the guide above seems to postpone the problem rather than solving it...
Any pointers?

Best regards,
Thomas Balsløv.

from devise-two-factor.

The guide should be changed to:

attr_encrypted :otp_secret,
  :key       => ENV['DEVISE_TWO_FACTOR_ENCRYPTION_KEY'],
  :mode      => :per_attribute_iv_and_salt,
  :algorithm => 'aes-256-cbc'

devise :two_factor_authenticatable,
  :otp_secret_encryption_key => ENV['DEVISE_TWO_FACTOR_ENCRYPTION_KEY']

I can open a PR for this if you'd like. Will the 3.0.0 release will be coming on RubyGems this week?

from devise-two-factor.

@P9GIT you'd have to take the application offline to decrypt the encrypted information, then re-encrypt it using the new encryption algorithm that attr_encrypted defaults to (aes-128-gcm) as well as the new mode (and a new encryption key if yours wasn't long enough before). aes-256-cbc isn't insecure, so you can get away with using it for probably a pretty long time, the problem is that if you want to switch mode or key you'll have to re-encrypt everything anyway, so you may as well do it all at the same time. This will eventually block you from upgrading to attr_encrypted 4.0 if/when it comes out if you don't do it now.

As for why my suggestions didn't work, I'm guessing you didn't use a key that was of sufficient length, so you have to use insecure_mode or attr_encrypted won't be happy. In my case I had a key that was long enough.

from devise-two-factor.

Hi! @connorshea
Thanks a lot for your reply, that helps a lot!

from devise-two-factor.

@P9GIT no problem, I've been researching this stuff for GitLab anyway, so I have lots of information hoarded :)

from devise-two-factor.