Table of Contents

Introduction

Jobs might require variables for parameterization that hold secrets. We find a number of requirements for management of such variables:

...

Encryption and decryption is performed directly by the related jobs.
No JS7 product is involved in encryption/decryption as otherwise the JS7 product would know the keys involved that potentially could be compromised by logging, database persistence etc.
Performing encryption/decryption by jobs limits the attack surface to the OS process executing the job. The job implementation is controlled by the user who can verify secure operation.

Asymmetric Keys

The basic proceeding works like this:

Consider the parties involved and related use cases:
- A job executed on Agent A should be parameterized by a variable holding a secret.
- A job executed on Agent B retrieves a secret that should be forwarded to a job on Agent A and possibly to other Agents too.
Use of asymmetric keys allows
- to create and to store a private key on Agent A.
- to use Agent A's public key on Agent B or any other system involved.
- to manage encryption and decryption like this:
  - create a symmetric one-time key and an encrypted copy of the key derived from Agent A's public key.
  - encrypt the value of a variable value with the one-time key.
  - drop the one-time key and forward the encrypted copy of the one-time key and the variable holding the encrypted value to Agent A.
  - only Agent A will be able to decrypt the encrypted one-time key using its private key which reveals the symmetric key required to decrypt the variable's value.

The solution is provided from examples for download and can be used to automate encryption and decryption of variables.

The solution is available
- from Unix for Linux and MacOS® using bash shell,
- from Windows, Linux and MacOS® using PowerShell version 7.x.
The solution is intended as a baseline example for customization by JS7 users and by SOS within the scope of professional services.

...