SimpleStringCipher.Encrypt/Decrypt using two different DefaultPassPhrase

TL;DR

ABP Setting values can be optionally encrypted but with a hardcoded DefaultPassPhrase that can never be changed. Not good from a security standpoint.

Details

The most common usage of SimpleStringCipher.Encrypt() or Decrypt() is SimpleStringCipher.Instance.Encrypt(plainText). Just need to pass in a single parameter, the rest are optional parameters which would fallback to the default values if not supplied. One of those parameters is passPhrase (2nd parameter) which would be assigned to the property SimpleStringCipher.DefaultPassPhrase if supplied. If not supplied, DefaultPassPhrase would just used the default value assigned in the constructor which is gsKnGZ041HLL4IM8: https://github.com/aspnetboilerplate/aspnetboilerplate/blob/efa1f18673762d143181dd0e34c006d4679bbe7a/src/Abp/Runtime/Security/SimpleStringCipher_NetStandard.cs#L46-L52

Changing/rotating the DefaultPassPhrase is easy. In appsettings.json, just add the following:

{
    "Configuration": {
        "EncryptionPassPhrase": "new_passphrase"
    }
}

Now, the value of ABP's Setting can also be optionally encrypted through its SettingDefinition.IsEncrypted property.

However, the value is encrypted also with SimpleStringCipher.Encrypt() but with additional parameters through SettingEncryptionService: https://github.com/aspnetboilerplate/aspnetboilerplate/blob/efa1f18673762d143181dd0e34c006d4679bbe7a/src/Abp/Configuration/SettingEncryptionService.cs#L16-L25

The DefaultPassPhrase is obtained from SettingEncryptionConfiguration which is also with the default value gsKnGZ041HLL4IM8: https://github.com/aspnetboilerplate/aspnetboilerplate/blob/efa1f18673762d143181dd0e34c006d4679bbe7a/src/Abp/Configuration/Startup/SettingEncryptionConfiguration.cs#L33-L39

But the SettingEncryptionConfiguration.DefaultPassPhrase cannot be changed in the same manner as SimpleStringCipher.DefaultPassPhrase which is a static string. Therefore, the new DefaultPassPhrase in appsettings.json is not picked up and used to encrypt/decrypt values in ABP Settings. There's no way to change SettingEncryptionConfiguration.DefaultPassPhrase and the hardcoded value is always used. Not only that it couldn't be easily changed from a config file, it couldn't be changed in our source codes too. There's no extension points exposed to let us latch on. The only way that I could think of is probably come up with our own implementation of ISettingsConfiguration and registering it in the IoC container overriding the default registration.

Summary

There are two DefaultPassPhrases used to encrypt different things in ABP. The default value of those DefaultPassPhrases is hardcoded to the same string value. One can be changed through config file and the other is not and will cause divergence.