Summary
CheckUser contains functionality to optionally store the encrypted recipients for emails sent via Special:EmailUser. The encryption mechanism used by this logic is outdated and needs an update, but since the feature appears to be unused, it may be better to completely remove it.
Note that CheckUser currently also stores an MD5 hash (not an encrypted ciphertext) of the recipient's email and user ID plus the MW install's secret key in the private events table. This MD5 hash is then displayed in the CheckUser results and is always enabled. There is no intention to change this functionality.
Background
- CheckUser contains functionality to optionally store the encrypted recipients for emails sent via Special:EmailUser in the cupe_private column
- This feature is off by default (including in WMF production), unless the operator set $wgCUPublicKey to a valid RSA public key.
- The RC4 cipher used by this feature is unavailable on many modern systems, e.g. Fedora and derivatives since 2015,[1] due to security concerns.
- It's not clear if anyone is actually using this functionality. It was implemented in https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/24503 without any BZ reference. There is also no maintenance script or UI where the stored data could be accessed by functionaries.
- Removing this functionality would allow us to drop the cupe_private column from the cu_private_event table as unused, as it is only used by this feature
[1] https://fedoraproject.org/wiki/Changes/RemoveSSL3andRc4
Acceptance criteria
- The functionality in CheckUser to store encrypted recipients of emails sent via EmailUser in the cupe_private column is either sunset due to lack of usage
, or this task is closed in favor of T384398. - CheckUser still keeps a hash of the recipient's email address, user ID and the local install's secret key in the cupe_params field for EmailUser events, like it has been doing.