Sequoia-PGP – A new OpenPGP implementation in Rust

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by Freak_NL on Thursday August 02, 2018 @04:27AM (#17670026)

Have you had a look at pass¹? It's a bash script that uses gnupg to encrypt secrets as gpg-encrypted plain text files. It has a very nice feature that allows you to specify a list of keys for all secrets in a specific directory (using a .gpg-id file).

Once set up, accessing the secrets is a matter of using the pass command line tool:

    pass edit some/secret
    # Copy the first line of a secret; by convention 
    # this is meant for a password:
    pass -c some/secret
    # Show the whole secret file:
    pass some/secret

    # Combined with git:
    pass git pull
    # Generate a 24-character random password:
    pass generate some/othersecret 24
    pass git push

We use pass to maintain a set of shared secrets with a small team. The (encrypted) files are pushed to private git repository (pass supports this out of the box).

1: https://www.passwordstore.org/

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by zx2c4 on Thursday August 02, 2018 @09:44AM (#17671288)

I wrote pass, originally just as just a dumb bash script that I was using privately, but then I put it on the Internet, and so all of the sudden there was a requirement to _not be awful_. The experience has been pretty frustrating, for precisely the reasons pointed out by GP: the gpg command line interface is atrocious. I'm required to parse things in a million crazy ways, buffer data myself, and work around all sorts of weird behaviors. All of that headache, and then in the end all I get is lame PGP crypto out of it? As I said, frustrating.

On the flip-side, at least we've (partially?) succeeded in taming the beast, and the end result is something moderately usable that you happily recommend to folks on HN. So that's good I suppose. :)

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by pferde on Thursday August 02, 2018 @10:02AM (#17671415)

An alternative is to use the GPGME library, which does all the ugly gpg output parsing for you. I realize, though, that a C library is not a solution for everything, especially not for a shell script that you want to keep a shell script. :)

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by zx2c4 on Thursday August 02, 2018 @10:47AM (#17671840)

Well... There's always https://github.com/taviso/ctypes.sh ...

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by pferde on Thursday August 02, 2018 @03:57PM (#17674938)

Holy crap, that's so cool. :) Thanks!

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by mike-cardwell on Thursday August 02, 2018 @09:52AM (#17671349)

I've been using pass for a year or two now. It's a great tool. Thank you for making it.

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by wfleming on Thursday August 02, 2018 @02:57PM (#17674394)

I'll also chime in to say that `pass` is a fantastic tool, and I'm so glad I switched to it as my password manager. So the effort you went through to get there (which I can sympathize with since I've had to use the OpenPGP CLI directly plenty of times) is very much appreciated.

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by tretiy3 on Saturday August 04, 2018 @03:53AM (#17685867)

Pass is amazing, thank you!

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by wuschel on Thursday August 02, 2018 @04:48AM (#17670091)

Out of interest: How big of a threat is keeping diff files/versioned encrypted containers around when it comes to preventing breaking the encryption? I could imagine that the additional information will reduce the security of the information.

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by simias on Thursday August 02, 2018 @05:59AM (#17670332)

The only problem I can foresee (assuming that the encryption scheme itself has no weaknesses to things like known plaintext attacks) is that it makes it harder to retire an old, potentially compromised key. You need to expunge the git history and any copies.

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by wuschel on Friday August 03, 2018 @08:10AM (#17679162)

Makes sense. Thank you.

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by esseti on Thursday August 02, 2018 @05:22AM (#17670212)

can you elaborate or point me to a resource how to use it to share secret for projects? i tried the pass, but it sotres the credentials in my home, i would rather prefer to have them in a file in the project, moreover, can also it encrypt .env files or some sort of it?

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by simias on Thursday August 02, 2018 @06:07AM (#17670353)

By default it does store passwords in ~/.password-store but you can override that with environment variables (see PASSWORD_STORE_DIR in the man page). I personally use thin wrapper scripts to change pass's behavior to suit my need. You can even fork it directly (and cautiously) if you want, it's just a relatively straightforward shell script after all.

>can also it encrypt .env files or some sort of it?

What are .env files? You mean the config dotfiles in your home directory? If so you'll probably have to use something like EncFS to encrypt these files. Personally I don't encrypt them but I also avoid storing cleartext passwords in them as much as possible, many unix programs support getting passwords from an application, for example in my muttrc I have:

    set imap_pass = `pass mail/myemail`

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by drexlspivey on Thursday August 02, 2018 @07:31AM (#17670669)

I found this brilliant way to manage your dotfiles in an old hn comment. https://news.ycombinator.com/item?id=11071754

<quote>

I use:

    git init --bare $HOME/.myconf
    alias config='/usr/bin/git --git-dir=$HOME/.myconf/ --work-tree=$HOME'
    config config status.showUntrackedFiles no

where my ~/.myconf directory is a git bare repository. Then any file within the home folder can be versioned with normal commands like:

    config status
    config add .vimrc
    config commit -m "Add vimrc"
    config add .config/redshift.conf
    config commit -m "Add redshift config"
    config push

And so one…

No extra tooling, no symlinks, files are tracked on a version control system, you can use different branches for different computers, you can replicate you configuration easily on new installation.

</quote>

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by danieldk on Thursday August 02, 2018 @08:50AM (#17671014)

No extra tooling, no symlinks, files are tracked on a version control system, you can use different branches for different computers, you can replicate you configuration easily on new installation.

But synchronizing shared configuration is clunky (you have to cherry pick commits between branches I guess).

I use NixOS and Nix on my MacBook, which allows you to store and version your whole system configuration. I have factored out different parts of my configuration (emacs, zsh, etc.) in different .nix files. So, I just have one file per machine where I import the relevant configurations and specify the packages that I want to have available. E.g. this is my user configuration on NixOS:

https://github.com/danieldk/nix-home/blob/master/machines/mi...

and macOS:

https://github.com/danieldk/nix-home/blob/master/machines/ma...

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by eiginn on Thursday August 02, 2018 @11:42AM (#17672293)

Thanks for sharing those, I had kind of written off Nix for personal laptop after first glance, going to play around again.

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by peatmoss on Thursday August 02, 2018 @11:08AM (#17672020)

This is brilliant! I think I'm about to go and replace some make-based infrastructure as a result.

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by esseti on Thursday August 02, 2018 @07:44AM (#17670722)

the software requires configurations. those are read from a .env file where there's name=value, i was wondering if this tool can help in enc/dec that, so on so for i've a gpg --symmmetric script to do that, but you have to know the password

[ Parent | on HN ]

Re:Sequoia-PGP – A new OpenPGP implementation in Rust by danieldk on Thursday August 02, 2018 @08:51AM (#17671021)

For project-specific secrets, you may want to look at git-crypt:

https://www.agwa.name/projects/git-crypt/

[ Parent | on HN ]