checkId: check.security.encryption plugin: stellaops.doctor.security severity: warn tags: [security, encryption, cryptography]

Encryption Keys

What It Checks

Validates encryption key configuration and algorithms. The check only runs when an encryption configuration section exists (Encryption, DataProtection, or Cryptography). It inspects:

When Algorithm is not explicitly configured, it defaults to AES-256.

Evidence collected: configured algorithm, key size, key rotation period, and the data protection keys path.

Why It Matters

Encryption protects data at rest and data protection keys used by ASP.NET Core for cookie encryption, anti-forgery tokens, and TempData. Weak algorithms (DES, 3DES, RC4) have known vulnerabilities and can be broken with modern hardware. Small key sizes reduce the keyspace, making brute-force attacks feasible. Without key rotation, a compromised key provides indefinite access to all encrypted data.

Common Causes

• Weak encryption algorithm configured (DES, 3DES, RC4, MD5, SHA1)
• Encryption key size too small (less than 128 bits)
• Key rotation period greater than 365 days or not configured
• Data protection keys directory does not exist on disk

How to Fix

Docker Compose

Set encryption configuration:

environment:
  Encryption__Algorithm: "AES-256"
  Encryption__KeySize: "256"
  Encryption__KeyRotationDays: "90"
  DataProtection__KeysPath: "/app/keys"

volumes:
  - stellaops-keys:/app/keys

Bare Metal / systemd

Edit appsettings.json:

{
  "Encryption": {
    "Algorithm": "AES-256",
    "KeySize": 256,
    "KeyRotationDays": 90
  },
  "DataProtection": {
    "KeysPath": "/var/lib/stellaops/keys"
  }
}

Create the keys directory:

sudo mkdir -p /var/lib/stellaops/keys
sudo chown stellaops:stellaops /var/lib/stellaops/keys
sudo chmod 700 /var/lib/stellaops/keys

Kubernetes / Helm

Set in Helm values and use a PersistentVolume for key storage:

encryption:
  algorithm: "AES-256"
  keySize: 256
  keyRotationDays: 90

dataProtection:
  persistentVolume:
    enabled: true
    size: "100Mi"

Verification

stella doctor run --check check.security.encryption

Related Checks

• check.core.crypto.available — verifies cryptographic algorithms are available at the OS level
• check.security.secrets — ensures encryption keys are not stored as plain text in configuration
• check.security.tls.certificate — validates TLS certificate for encryption in transit