Re:Show HN: S-Cache – Secure storage for cryptographic secre...
by loeg on Friday March 20, 2020 @11:17PM
(#22644088)
As you might imagine, there is some prior art in this space.
In broadly portable Unix userspace, there is GNOME Keyring. It takes special caution to pin secrets in memory (prevent swapping them to disk) and to zero out secrets before freeing them. For session-lifetime password store, it never writes the secrets to disk at all. Keyrings are encrypted with a key derived from a master password for each ring. I don't know what key derivation algorithm is used. For persisted secrets, I imagine they are stored encrypted on disk using something derived from the keyring password.
In the Linux kernel, there is the infrastructure behind the user interface keyctl(1). I am basically unfamiliar with it aside from knowing it exists.
On MacOS, there is Keychain. Ditto.
On Windows, there is the CryptProtectData / CryptUnprotectData family of functions, which theoretically ties the encryption to the current user. Using that nice primitive, one can just encrypt and then write out to any old file on disk.
In broadly portable Unix userspace, there is GNOME Keyring. It takes special caution to pin secrets in memory (prevent swapping them to disk) and to zero out secrets before freeing them. For session-lifetime password store, it never writes the secrets to disk at all. Keyrings are encrypted with a key derived from a master password for each ring. I don't know what key derivation algorithm is used. For persisted secrets, I imagine they are stored encrypted on disk using something derived from the keyring password.
In the Linux kernel, there is the infrastructure behind the user interface keyctl(1). I am basically unfamiliar with it aside from knowing it exists.
On MacOS, there is Keychain. Ditto.
On Windows, there is the CryptProtectData / CryptUnprotectData family of functions, which theoretically ties the encryption to the current user. Using that nice primitive, one can just encrypt and then write out to any old file on disk.