Encryption & Security
Relevant source files
The following files were used as context for generating this wiki page:
Infrahub Backup implements security measures to protect sensitive data during backup, collection, and restoration processes. The system primarily focuses on two areas: the encryption of backup archives using Elliptic Curve Integrated Encryption Scheme (ECIES) and the masking of sensitive information within troubleshooting bundles.
Encryption ensures that backup artifacts remain confidential even if stored in unsecured environments, such as S3-compatible object storage. Security masking prevents the accidental exposure of credentials—including passwords, tokens, and keys—when generating diagnostic reports for support purposes.
Backup Encryption (ECIES)
The project uses ECIES for file encryption, combining P-256 ECDH for key exchange, HKDF-SHA256 for key derivation, and AES-256-GCM for authenticated encryption.
Encryption Architecture
Encryption follows a V2 chunked format compatible with opsmill-upload. The process generates an ephemeral P-256 keypair for every encryption operation to derive a unique shared secret.
The diagram shows the sequence of cryptographic operations used to secure a file before storage.
Sources: src/internal/app/encryption.go:19-27, src/internal/app/encryption.go:138-228
Cryptographic Constants and Components
| Constant | Value | Description |
|---|---|---|
eciesVersion | 0x02 | Current version of the ECIES format. |
eciesChunkSize | 4 MiB | Size of plaintext processed in each encryption chunk. |
eciesHeaderSize | 86 bytes | Total size of the file header. |
eciesIVSize | 12 bytes | Size of the Initialization Vector for AES-GCM. |
eciesHKDFInfo | opsmill-upload-ecies | Info string used during HKDF key derivation. |
Sources: src/internal/app/encryption.go:28-34
Key Management
The system supports both hardcoded default keys and user-provided key files. Private keys are expected in PEM-encoded PKCS8 format, while public keys are handled as base64-encoded raw P-256 uncompressed points.
- Public Key Loading:
LoadPublicKeyFromBase64validates the 65-byte uncompressed point format (starting with0x04). - Private Key Loading:
LoadPrivateKeyFromFiledecodes PEM blocks and parses PKCS8 private keys. - Key Generation:
GenerateKeyPairproduces new P-256 ECDH keypairs for user configuration.
Sources: src/internal/app/encryption.go:62-136
Sensitive Data Masking
The collection tool implements secret masking to prevent sensitive data leakage in troubleshooting bundles. This is managed through a centralized masking function that identifies and redacts values associated with specific key names.
Masking Logic
The MaskSecrets function uses a case-insensitive substring match on key names. If a key contains a sensitive keyword, its value is replaced with a fixed string of asterisks (********).
The diagram illustrates the logic used to identify and redact sensitive fields within configuration and environment dumps.
Sources: src/internal/app/masking.go:10-30, specs/archive/003-collect-tool/plan.md:R5
Protected Data Sources
Masking applies to specific diagnostic outputs to ensure credentials are not included in support bundles:
infrahub-serverenvironment variables.- Server API configuration dumps.
- Redis
CONFIG GEToutput. - RabbitMQ
environmentandstatusdumps.
Sources: specs/archive/003-collect-tool/plan.md:R5
Security Implementation in CLI Operations
Security checks are integrated into the core CLI workflows, particularly during restoration and troubleshooting collection.
Restore Fail-Fast Gate
When restoring backups, the system identifies encrypted files by checking for the eciesVersion magic byte (0x02). The CLI implements a "fail-fast" policy: if the newest backup is encrypted but no decryption key is provided via --decrypt-key, the operation aborts immediately before performing any network or container operations.
Sources: src/internal/app/encryption.go:344-362, specs/005-restore-latest-backup/tasks.md:T004, specs/005-restore-latest-backup/tasks.md:T005
Troubleshooting Manifest
The infrahub-collect tool generates a bundle_information.json manifest. While it records the outcome of collectors, it ensures that the tool version, environment details, and Infrahub version are captured while excluding specific sensitive runtime states from the manifest itself.
Sources: src/internal/app/collect_manifest.go:10-50, specs/archive/003-collect-tool/plan.md:R6
Encryption and security mechanisms in Infrahub Backup provide a multi-layered approach to data protection. ECIES-based file encryption secures data at rest, while centralized masking logic protects credentials during active diagnostic collection, ensuring that both backups and troubleshooting data adhere to operational safety standards.