Leverage key service filters to only allow specific storage methods

[nerdstein]

-File
-File Path

This then restricts the use of configuration based key types (e.g. SimpleKey) which are not advantageous for security

[nerdstein]

What would be really handy would be have a settings form that an admin selects which storage methods they want to allow in the encryption form

[nerdstein]

This should be another requirement of the Encryption Profile UI.

We should just show the key type with the key, e.g. "Key 1 (config)" or "Key 2 (file)" in the selection of a Key

[svendecabooter]

A first part of this is added in this pull request: #67

The form now uses the "key_select" form element. This can easily be expanded to also filter on the key provider, and only allow "file" providers.

Though I'm not sure what the best approach would be to make clear that people should use the File provider, without actually providing a hard-coded limitation (since sites might define a custom KeyProvider plugin that is also secure). I think this should be more discussed before a code solution is created.

[rlhawk]

There's a lot going on with this issue, so I'll see if I can summarize it:

• We want to be able to allow site admins the ability to prevent encryption using keys that are stored insecurely. This would likely take the form of a configuration setting for Encrypt.
• We don't want to specifically steer users to the "file" storage type, since there will be other, more secure, storage options available. We should discourage people from using the Configuration storage type in production, but it can be very useful in development.
• The key provider should be displayed when a key is selected. This would give admins information about how securely a key is being stored when the choose it. This seems as though it could be nice, but I don't think it's essential.
• We could provide even more fine-grained control over what keys are available, by allowing admins to specify requirements for specific settings associated with the key provider, such as preventing or allowing certain file paths (for the File key provider). Again, I think this could be useful, but it's probably something to consider after 1.0 is released.
• I definitely would like to use the key_select element, but we're planning to allow key filtering based on key type group ("encryption", in this case) and even key size and those filters are not currently supported by the element. It might not be that big of a deal to add that support, but the simpler way to go in the short term is just to create the field with a standard select element and populate #options ourselves. We can always change it later, once filtering in Key is more sophisticated.

[rlhawk]

I would like to postpone this issue for now, but please chime in if you disagree.

[svendecabooter]

See https://www.drupal.org/node/2678084 for followup