alvaro/normogen
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions
normogen/docs/archive/ENCRYPTION_UPDATE_SUMMARY.md
goose e322145ffb
Some checks failed
Lint and Build / format (pull_request) Successful in 37s
Details
Lint and Build / clippy (pull_request) Successful in 1m40s
Details
Lint and Build / build (pull_request) Successful in 3m44s
Details
Lint and Build / test (pull_request) Failing after 0s
Details
docs: decide multi-person ZK sharing ADR; reconcile jwt/encryption docs 
Rewrite the encryption/persona/JWT docs to match the implemented code and
record the multi-person sharing design.

- multi-person-sharing.md (NEW): ADR for per-profile DEK + X25519 envelope
  sharing. All five original open questions resolved 2026-07-18. Covers
  divorced-parents, pets, graduation, and elderly-parent care; adds an
  admin permission tier for owner-incapacity. Decided, not yet implemented.
  (#3)
- encryption.md: full rewrite to the implemented wrapped-DEK / Web Crypto
  model; the old version described ZK encryption as 'planned'. (#4)
- jwt-authentication-decision.md: rewritten to match implementation
  (PBKDF2 not bcrypt, no Redis, token_version revocation, real Claims).
  Original aspirational content preserved in a History section. (#4)
- PERSONA_AND_FAMILY_MANAGEMENT.md: 'Current reality' section added, old
  'Implementation Status' marked superseded, encryption section corrected. (#4)
- ENCRYPTION_UPDATE_SUMMARY.md: archived (changelog for a rewrite that
  itself went stale). (#4)
- ADR README index updated for the new + reconciled entries.
2026-07-18 19:26:43 -03:00

3.3 KiB
Raw Blame History

Encryption.md Update Summary

ARCHIVED 2026-07-18. This was a changelog note for a 2026-03-09 rewrite of docs/product/encryption.md that itself became stale (it describes ZK encryption as "planned" when it is in fact implemented). Kept here for history only. The current, accurate encryption doc is docs/product/encryption.md, and the canonical design is docs/adr/zero-knowledge-encryption.md. See issue #4.

Date: 2026-03-09
File: docs/product/encryption.md
Update: Added Rust implementation examples and current status

Changes Made

1. Added Implementation Status Section 🆕

  • Currently implemented features marked with ✅
  • Planned features marked with 📋
  • Clear distinction between design and implementation

2. Added Rust Implementation Examples 🆕

Current Security Features:

  • JWT Authentication Service (actual code from backend/src/auth/mod.rs)
  • Password Hashing with PBKDF2 (100,000 iterations)
  • Rate Limiting Middleware (tower-governor)
  • Account Lockout Service (exponential backoff)
  • Security Audit Logger (MongoDB logging)

Proposed Encryption Features:

  • Encryption Service design (AES-256-GCM)
  • Encrypted Health Data Model
  • Deterministic Encryption for searchable fields
  • Key Management Strategy
  • Shareable Links implementation

3. Updated Code Examples

  • Replaced JavaScript/Node.js examples with Rust
  • Used actual implementation from Normogen codebase
  • Added real-world examples from existing code
  • Maintained theoretical examples for planned features

4. Added Comparison Table

  • Current Implementation vs Proposed
  • Implementation status for all features
  • Priority and complexity ratings

5. Updated Dependencies

  • Listed currently used crates (jsonwebtoken, pbkdf2, etc.)
  • Proposed additions for encryption features

File Statistics

Before

  • Size: 32KB
  • Lines: 1,248
  • Language: JavaScript/Node.js examples
  • Focus: Theoretical design

After

  • Size: 28KB (slightly smaller)
  • Lines: ~1,100
  • Language: Rust examples (matching backend)
  • Focus: Current implementation + future design

Key Improvements

  1. Accurate: Reflects actual implementation status
  2. Rust-focused: Matches backend technology
  3. Practical: Real code from codebase, not just theory
  4. Clear: Distinguishes between implemented and planned
  5. Comprehensive: Covers current security + future encryption

Implementation Coverage

Currently Implemented ✅

  • JWT authentication (15min access, 30day refresh)
  • PBKDF2 password hashing (100K iterations)
  • Rate limiting (15 req/s, burst 30)
  • Account lockout (5 attempts, exponential backoff)
  • Security audit logging
  • Session management

Planned for Future 📋

  • End-to-end encryption
  • Client-side encryption
  • Zero-knowledge encryption
  • Shareable links with embedded passwords
  • Key rotation

Next Steps

  1. ✅ Document current security implementation
  2. ✅ Add Rust code examples
  3. 📋 Implement zero-knowledge encryption (Phase 3+)
  4. 📋 Add client-side encryption
  5. 📋 Implement shareable links

Update Complete: 2026-03-09
Status: Documentation now matches actual implementation
Quality: Improved accuracy and relevance