Package: william_blake_crypto
william_blake_cryptoThis package canconvert a YAML object to an encrypted string object and back,convert a YAML file to an encrypted file and back,decrypt an encrypted file to a YAML object,and can generate, input and load a key for these purposes.This package should be used in addition to other security measures, such
as running it on an operating system with an encrypted partition (e.g.
ecryptfs, LUKS) and with SSH passcode access disabled.Using this module, a key should be generated and saved securely.In production, robust security is assumed to be required, so a script
using this package can request the key as amanual inputthat is
provided by the user when the script is launched and then the script can
use this key, which exists solely in the volatile memory associated with
the script, to decrypt an encrypted file to a YAML object; for example,
an encrypted configuration file.In development, a key can be generated and saved to a file such as~/.config/william_blake_crypto/keywhich can be loaded by the
package without the need for manual input, but this is not a secure
approach so should be used only for development, not production.setuppipinstallwilliam_blake_cryptogenerate key>>>importwilliam_blake_cryptoaswbc>>>wbc.generate_key()b'rojTAcN-Tjy6W43BUozbFIhIA2jq076KysjUj8l8N4E='So, for production, this key could be saved to a file such as~/.config/william_blake_crypto/key. The exact contents of the file
in this example would be as follows:rojTAcN-Tjy6W43BUozbFIhIA2jq076KysjUj8l8N4E=input key (for production)>>>importwilliam_blake_cryptoaswbc>>>wbc.input_key()key:>>>wbc._keyb'rojTAcN-Tjy6W43BUozbFIhIA2jq076KysjUj8l8N4E='The idea is that this key is stored securely (perhaps in a VeraCrypt
volume file) and copy-pasted into the terminal in which the script is
launched when the key is requested. This ensures that the key exists
only in the volatile memory associated with the running script, and is
not accessible as a plaintext file (which would be viewable by a
cracker).load key (for development)For development, generate a key (as described above) and save it to a
file such as~/.config/william_blake_crypto/key, which is the
default location for this keywhich is intended for development use
only(though the path of this key can be specified as an argument for
the functionload_key.>>>importwilliam_blake_cryptoaswbc>>>wbc.load_key()>>>wbc._keyb'rojTAcN-Tjy6W43BUozbFIhIA2jq076KysjUj8l8N4E='encrypting and decrypting YAML objects>>>importwilliam_blake_cryptoaswbc>>>wbc.load_key()>>>config={"passcode":12345}>>>token=wbc.encrypt_yaml(content=config)>>>tokenb'gAAAAABbhGbVUVbbneKoz7wvV8aOF9K6r1hSNQvDexfAflIML33iyNa_Nf7Nm6g6syIXBkyANTHw3RlGMIsCgDligdts78a6VxrBaxbOIhGqSkzNtA5GDK4='>>>wbc.decrypt_yaml(token=token){'passcode':12345}converting a YAML file to an encrypted YAML file and decrypting it$echo"{'passcode': 12345}">test.yaml>>>importwilliam_blake_cryptoaswbc>>>wbc.load_key()>>>wbc.yaml_file_to_encrypted_file(filepath_yaml="test.yaml",filepath_encrypted="test.cyaml")$cattest.cyamlb'gAAAAABbhGzog6kLduLbflVx49jUD6WmIuRw8h0V7X25LrW6LnKjxbLN0pE7jMMeY9qaeGysjLsz-XA8EZ_LQVGslXhicpxLtt9K0CYFFYv2UZ3XEDt8oEI='>>>importwilliam_blake_cryptoaswbc>>>wbc.load_key()>>>config=wbc.encrypted_file_to_yaml(filepath="test.cyaml")>>>config{'passcode':12345}converting an encrypted YAML file to a YAML file>>>importwilliam_blake_cryptoaswbc>>>wbc.load_key()>>>wbc.encrypted_file_to_yaml_file(filepath_yaml="test2.yaml",filepath_encrypted="test.cyaml")$cattest2.yaml{passcode:12345}futureUnder consideration are ways to use time-based one-time passcodes (TOTP)
in place of a static key, perhaps usingche_guevara_otp.