Package: chiff
Chiff CLIChiff is a tool that allows you to store secrets in the secure storage of your phone and retrieve them when you need them by authorizing a request.
You can pair the app with multiple clients (browser extension or shell).MotivationSSH keys are stored in plaintext on your computer by default, unless you choose a passphrase. However, it can be cumbersome to retype your password every time you need to decrypt your keys. The same applies to credentials for various CLIs. For example,official AWS CLI documentationrecommends to store your credentials in~/.aws/credentials.With Chiff, you can leverage the biometric capabilities and secure storage of your phone to authenticate to services on your computer. You can pair with multiple shells to be able to retrieve credentials there.Security modelAll sensitive data is stored encrypted on your phone. When needed, it is decrypted (by authenticating to your phone with biometrics) and sent to the browser/cli, where it is filled in the website. An end-to-end encrypted channel is established between browser/cli by scanning a QR-code. This means confidentiality is ensured, even though the server (mainly serving as message broker and backup storage) is modelled as an untrusted entity.Related projectsThis is the repository for theCLI.For theAndroid app, seechiff-android(Coming soon).For theBrowser extension, seechiff-browser(Coming soon).For theiOS app, seechiff-ios.
For theiOS app core, seechiff-ios.InstallationPackage is available on PyPi.
The easiest way is to usepipx:pipx install chiff. This should installchiffandchiffdto your shell.Installation from sourceAfter cloning the project, you can build it usingpoetry.
Runpoetry buildto build the source package and wheel binary. Install the script withpipx install ./. This should installchiffandchiffdto your shell.Set-upTo set up the ssh-agent, you can runchiff init. This sets upchiffdas a background script and adds the following to your~/.ssh/config:Host *
   IdentityAgent "~/Library/Application Support/Chiff/chiff-socket.ssh"You can also set this up manually. For example, if you only want to use Chiff for specific hosts you can setIdentityAgent "~/Library/Application Support/Chiff/chiff-socket.ssh"for hosts that should use Chiff.Get the Chiff appGet the Chiff app on App Store or Play Store:Follow the onboarding instructions in the app. When the app asks you to pair with your browser, you can pair with this CLI instead (seePairing).UsagePairingThe first thing you should do is pair with your phone withchiff pair. This generates a QR-code that you can scan with
the Chiff app. After pairing, you can see your accounts withchiff status.
You can pair with one app at the same time, so if you want to pair with another phone, runchiff unpairto delete the
session.Generating an SSH keyYou can generate an SSH key on your phone withchiff ssh-keygen -n <name>. This sends a request to your phone to generate the key.
Chiff can generate two types of keys:Ed25519: This is the default algorithm. The key is backed up on your chiff seed and can be restored.The key is not generated in the Secure Enclave.ECDSA256: This key can be generated with the-eflag and is generated in the Secure Enclave (iOS only). This is more secure,but the key won't be restored with your backup.Pick whatever suits your needs. Generating the key will directly print out the ssh public key, but you can always find this by runningchiff status.Logging in with sshMake surechiffdis running and theIdentityAgentis set up in your~/.ssh/configand the host has a public set in~/.ssh/authorized_keys. Then just log in withssh user@hostand you should get a push message on your phone. If the key is not present in Chiff, the request is being forwarded to the originalssh-agent.Retrieving passwordsThe Chiff CLI allows you to get passwords and notes from your accounts withchiff get. It takes the following arguments:-i,--idTEXTTheidoftheaccountyouwantthedatafor[required]-n,--notesReturnthenotesoftheaccount-j,--format-jsonReturnaccountinJSONformat({"username":"example","password":"secret","notes":"important note"|undefined})By default, it just return the password without any extra output, so it can be easily used in scripts.
The account id is required and can be found by checking the overview withchiff status.Adding accountsAdd new accounts withchiff add. It takes the following arguments:-u,--usernameTEXTTheusernameoftheaccountyouwanttoadd[required]-l,--urlTEXTTheURLoftheaccountyouwanttoadd[required]-s,--nameTEXTThenameoftheaccountyouwanttoadd[required]-p,--passwordTEXTThepasswordoftheaccountyouwanttoadd.Willbepromptedforifnotprovided-n,--notesTEXTThenotesoftheaccountyouwanttoaddThis will send a request to your phone, where you can authorize the account.Updating accountsSimilarly, you can update existing accounts withchiff update.-i,--idTEXTTheidoftheaccountyouwantthedatafor[required]-u,--usernameTEXTTheusernameoftheaccountyouwanttoupdate-l,--urlTEXTTheURLoftheaccountyouwanttoupdate-s,--nameTEXTThenameoftheaccountyouwanttoupdate-p,--passwordTEXTThepasswordoftheaccountyouwanttoupdate.Willbepromptedforifargumentisnotprovided-n,--notesTEXTThenotesoftheaccountyouwanttoupdateThe account id is required and can be found by checking the overview withchiff status.ImportingYou can import accounts from a CSV, JSON or kdbx file withchiff import.-f,--format[csv|json|kdbx]Theinputformat.Ifdataiswrittentoa.kdbxdatabase,thepathtoanexisting.kdbxdatabasefileneedstobeprovidedwith-p.[required]-p,--pathPATHThepathtowherethefileshouldbereadfrom.[required]-s,--skipWhetherthefirstrowshouldbeskipped.OnlyrelevantwhenformatisCSV.Importing from CSVImport from a csv file withchiff import -f csv -p <path>. You can skip the first row with the-sflag. The data is expected to be separated with commas, for example:"title", "url", "username", "password", "notes"
"Google", "https://google.com", "john_doe@gmail.com", "p@ssword", "important note"Importing from JSONImport from a json file withchiff import -f json -p <path>. The data is expected to be formatted as follows:[{"title":"Google","url":"https://google.com","username":"john_doe@gmail.com","password":"p@ssword","notes":"important note"}]Importing from kdbxImport from a json file withchiff import -f kdbx -p <path>. You will have to enter your password. Note that Chiff relies on the URL being present and correct, so it's necessary to make sure each account has the URL set, as well as the title, username and password. Notes are optional.FAQI'd like to forward requests to another SSH agentBy default, Chiff forwards the requests to the ssh-agent that is present in theSSH_AUTH_SOCK, environment variable. If you have changed this in~/.bashrcor equivalent, it may not be available to the background process. You can adjust the LaunchAgent plist or systemd service manually to set. For example, if you would like to use Chiff in combination withsecretive, you add the following to~/Library/LaunchAgents/co.chiff.chiffd.plist:<key>EnvironmentVariables</key><dict><key>SSH_AUTH_SOCK</key><string>/Users/username/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh</string></dict>Then reload it withlaunchctl load -w ~/Library/LaunchAgents/co.chiff.chiffd.plist. If the key is present in Chiff, they request will be handled by Chiff. If not, it will be forwarded to the secretive ssh agent.ContributingTo contribute, follow these steps:Fork this repository.Create a branch from themainbranch:git checkout -b <branch_name>.Make your changes and commit them:git commit -m '<commit_message>'Push to the original branch:git push origin <project_name>/<location>Create the pull request to themainbranch.Alternatively see the GitHub documentation oncreating a pull request.LicenseThis project is licensed under the terms of the GNU GPLv3.