I'm trying to understand Maven 3's[password encryption feature. I have found that this feature is poorly documented and confusing. For example, the feature documentation and a blog post by the author of the feature contradict each other about several points.
This question is broader than How does maven --encrypt-master-password work and is not covered by Maven encrypt-master-password good practice for choosing password.
Specifically, I am trying to answer the following questions which are not covered by the documentation. I've put what information I have been able to gather so far below each question in italics.
settings-security.xml
in a folder that only one user can access (~/.m2
)? If so, why bother with encrypting a 'master password' (why not just use some random value)? Isn't the 'master password' really just an entropy input to the cryptographic function? Calling it a password is confusing - I expected Maven to prompt me for this password before de-crypting any encrypted server passwords, but it did not.My understanding is that yes, this only provides security by existing in an operating-system protected file. I believe Maven allows you to encrypt a master password so that if you loose the settings-security.xml
file you can re-generate it. Is this correct?
Marcelo Morales' answer on How does maven --encrypt-master-password work links to the plexus-cihper project on GitHub. It isn't clear if that is just the cipher, or the actual Maven plugin that provides the password functionality though.
I have no idea.
settings-security.xml
file, even though the encrypted master password ciphertext is now different. Can someone explain how this works?I have no idea. This seems to me like Maven is doing something fishy or storing cleartext somewhere.
<server />
tags in the settings.xml
file. is this true? Where can servers defined in settings.xml
be used?My understanding is that <server />
definitions can be used in <repositories />
and <distributionManagement />
, but not <scm />
. Can someone verify this?
I have no idea
Sorry for the wall of text, and thanks for any answers.
The master password is an input into the cryptographic function for encrypting/decrypting the server passwords. If someone has your individual encrypted server passwords, they won't be able to decrypt them unless they also have your master password. This means you can freely share your maven settings.
When you run a Maven build that needs to interact with the repository manager, Maven will retrieve the Master password from the ~/. m2/settings-security. xml file and use this master password to decrypt the password stored in your ~/. m2/settings.
Use of two-way encryption protects the password stored in the database, while supporting use authentication methods like DIGEST-MD5 that require the server to have access to the clear text password, and supporting applications that may need the clear-text password.
My answer is based on reading the Maven source code and doing a little research.
- Does the encrypted master password provide security simply by existing in
settings-security.xml
in a folder that only one user can access (~/.m2
)? If so, why bother with encrypting a 'master password' (why not just use some random value)? Isn't the 'master password' really just an entropy input to the cryptographic function? Calling it a password is confusing - I expected Maven to prompt me for this password before de-crypting any encrypted server passwords, but it did not.
The master password is an input into the cryptographic function for encrypting/decrypting the server passwords. If someone has your individual encrypted server passwords, they won't be able to decrypt them unless they also have your master password. This means you can freely share your maven settings.xml file with others, without them being able to decrypt your server passwords. This is also why the master password is kept in a separate file.
This rationale is somewhat explained in encryption guide
- Do the master password and server passwords use the same encryption process/cipher? The server passwords are based on the master password, so there must be some difference in the algorithm. Where is the source code for this located?
From what I can tell, the master password is encrypted using the same cipher as the server passwords. When decrypting the server passwords, the master password (unencrypted form) is an input; when decrypting the master password, the magic string '"settings.security"' is used as the additional input.
You can see the source code PBECipher and MavenCli.java.
- I have observed that the same master password or server password encrypted multiple times gives different hashes. According to Marcelo Morales' answer on How does maven --encrypt-master-password work, this is because 'a JVM-configuration-specific (usually SHA1PRNG) 64-bit random salt' is added to the password prior to encrypting. Maven decrypts stored passwords when they are used at compile time. Doesn't this mean the salts have to be stored somewhere?
A traditional approach to handling salts is that the random salt is stored with the encrypted text, alongside it. See the Wikipedia article.
Based on the source code linked above, the salt appears to be stored as the first 8 bytes of the Base64 decoded bytes, right before the encrypted password.
- I have also observed that a regular password encrypted using one encrypted master password will still work if the master password is re-encrypted and stored in the
settings-security.xml
file, even though the encrypted master password ciphertext is now different. Can someone explain how this works?
This is because the decrypted form of the master password is used, not the encrypted "ciphertext". Thus re-encrypting it doesn't affect the server password encryption/decryption.
I don't know the answer to your last two (5 and 6) questions.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With