Migrate from v4.3.1 to v4.3.2

[Fosse]

From version v4.3.2 the config parameter "secret_iv" is required. I've used the NzoUrlEncryptorBundle without a "secret_iv" in the past. How can I migrate to v4.3.2 without losing my data?

So my current configuration basically is just:

nzo_url_encryptor:
  secret_key: ************```

[nayzo]

Unfortunately there is no straight forward way to do that, unless you re-enter your data again after setting the iv secret.
The secret_iv is required to guarantee more security to the encrypted data.

[Fosse]

Thank for your quick response.

Would it not be possible to include some functionality to allow people to still decrypt those values? Something like the following:

/**
 * Decrypt values created without Iv
 *
 * @param string $encrypted
 * @return string
 * @deprecated
 */
public function decryptWithoutIv($encrypted)
{
	$decrypted = openssl_decrypt(
		$this->base64UrlDecode($encrypted),
		$this->cipherAlgorithm,
		$this->secretKey,
		0,
		substr(hash(self::HASH_ALGORITHM, $this->secretKey), 0, 16)
	);

	return trim($decrypted);
}

[nayzo]

This will make maintaining the bundle more harder and less secure !
On your own risk you can still be using the v4.3.1 but it's not recommended.

[Fosse]

I understand that part. However I'm afraid that this way people are forced into using an old version just because there's basically no way to simply upgrade. People staying indefinitely at an old version feels like even a bigger security risk.

Either way I think that most people would assume that a patch version change would not lead to backward incompatibility. Add the issue that there's basically no way to migrate from 4.3.1 to 4.3.2 for this use case I would say it would be worth it to add some functionality to help people out.

I assume this could be a special version number designed for migration to prevent such code in the normal releases I guess.

[nayzo]

I see your point, but it is the pupose of the security patch. There is no meaning in having a speacial version if the changes are the same as the old version. This will lead to more confusion !
There is only two cases here:

• 1: staying with old version but with security risks.
• 2: upgrading to the new version and make the needed changes.

There is no other option I'm afraid.