1"use strict";(self.webpackChunkuser_handbook=self.webpackChunkuser_handbook||[]).push([[5231],{5958:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>a,contentTitle:()=>i,default:()=>l,frontMatter:()=>s,metadata:()=>c,toc:()=>p});var n=r(5893),o=r(1151);const s={sidebar_position:1},i="Profile Encryption & Storage",c={id:"components/cwtch/profile-encryption",title:"Profile Encryption & Storage",description:"Profiles are stored locally on disk and encrypted using a key derived from user-known password (via pbkdf2).",source:"@site/security/components/cwtch/profile-encryption.md",sourceDirName:"components/cwtch",slug:"/components/cwtch/profile-encryption",permalink:"/security/components/cwtch/profile-encryption",draft:!1,unlisted:!1,tags:[],version:"current",sidebarPosition:1,frontMatter:{sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Cwtch",permalink:"/security/category/cwtch"},next:{title:"Message Formats",permalink:"/security/components/cwtch/message_formats"}},a={},p=[{value:"Unencrypted Profiles and the Default Password",id:"unencrypted-profiles-and-the-default-password",level:2},{value:"Related Code",id:"related-code",level:3}];function d(e){const t={a:"a",h1:"h1",h2:"h2",h3:"h3",p:"p",...(0,o.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"profile-encryption--storage",children:"Profile Encryption & Storage"}),"\n",(0,n.jsx)(t.p,{children:"Profiles are stored locally on disk and encrypted using a key derived from user-known password (via pbkdf2)."}),"\n",(0,n.jsx)(t.p,{children:"Note that once encrypted and stored on disk, the only way to recover a profile is by rederiving the password - as such\nit isn't possible to provide a full list of profiles a user might have access to until they enter a password."}),"\n",(0,n.jsx)(t.h2,{id:"unencrypted-profiles-and-the-default-password",children:"Unencrypted Profiles and the Default Password"}),"\n",(0,n.jsxs)(t.p,{children:['To handle profiles that are "unencrypted" (i.e don\'t require a password to open) we currently create a profile\nwith a ',(0,n.jsx)(t.a,{href:"https://git.openprivacy.ca/cwtch.im/cwtch/src/branch/master/app/app_constants.go#L6",children:"defacto, hardcoded password"}),"."]}),"\n",(0,n.jsx)(t.p,{children:"This isn't ideal, we would much rather wish to rely on OS-provided key material such that the profile is bound to a\nspecific device, but such features are currently patchwork - we also note by creating an unencrypted profile, people\nwho use Cwtch are explicitly opting into the risk that someone with access to the file system may be able to decrypt\ntheir profile."}),"\n",(0,n.jsx)(t.h3,{id:"related-code",children:"Related Code"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.a,{href:"https://git.openprivacy.ca/cwtch.im/cwtch/src/branch/master/peer/storage.go",children:"https://git.openprivacy.ca/cwtch.im/cwtch/src/branch/master/peer/storage.go"})})]})}function l(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},1151:(e,t,r)=>{r.d(t,{Z:()=>c,a:()=>i});var n=r(7294);const o={},s=n.createContext(o);function i(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:i(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.