Skip to content

Allow re-encrypting attributes when app uses previous keys #1049

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

JaZo
Copy link

@JaZo JaZo commented Jun 25, 2025

In #1033 the compare method is introduced, which is really nice! However, as Laravel now thinks the value is equal, it's impossible to "re-encrypt" the attributes without changing the actual value.

Issue

Say you have a model that uses one of the casts provided by this package and have set it up to encrypt that data. Afterwards, you rotate the app key and set the app previous keys. Laravel handles decrypting the value using your new or old key, whichever works. Now you want to get rid of the previous key, maybe it's leaked, and have all data encrypted using your new key. With the "native" encrypted casts provided by Laravel, the value is re-encrypted using the new key and marked as dirty on update (see https://github.com/laravel/framework/blob/959fac8/src/Illuminate/Database/Eloquent/Concerns/HasAttributes.php#L2284-L2285 for details). So if you want to re-encrypt all data, you can just loop over all models, set the attribute to trigger a re-encrypt, and save them. However, since version #1033 introduced the compare function, Laravel thinks the values are equal and it doesn't mark the attribute as dirty and doesn't save the re-encrypted value.

Solution

By implementing the same logic as Laravel, i.e. marking the attribute as dirty when there are previous encryption keys, we restore the ability to re-encrypt all data.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant