{"id":473,"date":"2024-12-03T17:11:24","date_gmt":"2024-12-03T17:11:24","guid":{"rendered":"https:\/\/bestworlds.com\/blog\/?p=473"},"modified":"2024-12-03T19:34:36","modified_gmt":"2024-12-03T19:34:36","slug":"introducing-bestworlds-new-encryption-key-rotation-module-for-magento-2","status":"publish","type":"post","link":"https:\/\/bestworlds.com\/blog\/introducing-bestworlds-new-encryption-key-rotation-module-for-magento-2\/","title":{"rendered":"Introducing BestWorlds\u2019 New Encryption Key Rotation Module for Magento 2"},"content":{"rendered":"\n

We\u2019re excited to introduce BestWorlds\u2019 Encryption Key Rotation Module<\/a> for Magento 2. This module helps you securely rotate encryption keys in response to the Cosmic Sting vulnerability<\/a> disclosed on September 26, 2024. This vulnerability exposed JWT Admin Tokens, which could reveal your current encryption keys.<\/p>\n\n\n\n

Why You Need to Rotate Your Encryption Keys<\/h2>\n\n\n\n

Magento has recommended key rotation to mitigate this vulnerability. You can generate new keys through the Magento admin interface, but replacing old keys is crucial because the vulnerability exposed them. Magento\u2019s patch helps prevent the use of old keys, especially for JWT Tokens, but rotating keys in the admin interface didn\u2019t fully resolve the issue for encrypted third-party data.<\/p>\n\n\n\n

After researching other solutions (like the SanSec module), we found them too complex and potentially problematic, so we created a simpler, more reliable option.<\/p>\n\n\n\n

Our Solution: The Encryption Key Rotation Module<\/h2>\n\n\n\n

Our Encryption Key Rotation Module<\/a> simplifies the process. With a single command, you can replace your old encryption key with a new one, ensuring everything on your site continues working seamlessly.<\/p>\n\n\n\n

Key Features of the Module<\/h2>\n\n\n\n

Here\u2019s how the module works:<\/p>\n\n\n\n

    \n
  1. Generate a New Encryption Key:<\/strong> The module creates a new key and adds it to your configuration. You can provide your own key or let Magento generate one automatically (which we recommend).<\/li>\n\n\n\n
  2. Re-encrypt Two-Factor Authentication (TFA) Values: <\/strong>It updates your TFA encrypted values to keep them secure.<\/li>\n\n\n\n
  3. Re-encrypt All Database Values: <\/strong>The module re-encrypts all database values, including encrypted data from third-party modules.<\/li>\n\n\n\n
  4. Update Image Cache Directory Names: <\/strong>It changes image cache directory names to match the new encryption key. Unlike Magento\u2019s default key rotation process, which requires regenerating all cached images, this module makes it easier.<\/li>\n<\/ol>\n\n\n\n

    Managing Cache Images: Choose Your Approach<\/h3>\n\n\n\n

    In the admin panel (Stores -> Configuration -> BestWorlds -> Encryption Key), you can choose how to handle cache images:<\/p>\n\n\n\n