opensecret 0.0.988 → 0.0.9925

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 66c7d8d35a57f8a3cdb9b474e91449ec0e99860a
-  data.tar.gz: 613a5d83b7106f5ba575375a19d2afd2a800349a
+SHA256:
+  metadata.gz: 8f4b662ec6f5f735a69275b840d1e1e86e7aee004c98251891ad0cd376d5a6e2
+  data.tar.gz: fd3e9024651b0ae1a113e7a1231ea8385bc55b1e51c5789acca1408134a15246
 SHA512:
-  metadata.gz: b7f868866c2aeaefdf7175bc3908c6fd099c9b012459cabb95ce896bb3cbf97c07669e37fd821463d604e1a8b24096e7ba7522d2976a997e0e868402bae223d2
-  data.tar.gz: e4c370058f6531ba3195d2555b8f1e53e3fbd61d27d8ebbbd5acce7dd71aa243c57e7c2558254aa8ba78a94b434e321494cc196fbcd035aaeef833c88d0faf17
+  metadata.gz: ef7586640543b9bdd9845e3c33217a4a02e1546d96f433884ab9a4db18ea09b051157fda0b3eed42e5e9961a72afe42298b21cbc217ae1220e9e55bcf4171ee8
+  data.tar.gz: 6dd7f152e8b66f7657a29327cd4a37b7addde818270a51396594c365808b20fd7b3e13b13c6eec32eacc6e4b1e05e367241fbb47f8d54bdc4407a34c96ddb1d0

data/README.md

@@ -4,170 +4,79 @@ opensecret [![Build Status](https://secure.travis-ci.org/TwP/inifile.png)](http:
 opensecret | Install and Configure
 -----------
 
-opensecret locks secrets and sensitive data in a simple and highly secure manner. <b><em>It never accesses the cloud</em></b>. It produces files that are precious to you but <b><em>worthless</em></b> to everyone else. As well as the filesystem, you can choose Git, Amazon S3 or a remote drive as your backend store.
+opensecret locks secrets and sensitive data in a simple and highly secure manner. <b><em>It never accesses the cloud</em></b>. It produces files that are precious to you but <b><em>worthless</em></b> to everyone else.
 
 opensecret takes a fresh approach in its quest to be both simple and highly secure.
 
-
-### Install
+## install opensecret
 
     $ gem install opensecret
+    $ export OPEN_SESSION_TOKEN=`ops token`     # setup a shell session variable
+    $ ops init joe@abc /home/joe/credentials   # initialize a secrets domain
+    $ ops login joe@abc                        # login to the new domain
 
-### Initialize
-
-    $ opensecret init joe@example.com
-
-It doesn't have to be an email address. <tt>smith.family.info</tt> will do just fine. Choose a memorable (but not easily guessable) password.
-
-### Open envelope | Put secrets | Seal envelope
-
+You initialize then login to a **domain** like **joe@abc**. In the init command we specify where the encrypted material will be stored. Best use a USB key or phone to use your secrets on any drive or computer.
 
+You only need to run init once on a computer for each domain - after that you simply login.
 
-- <tt>**keydir**</tt> &raquo; best practise is a usb key drive with your **actual keys**
-- <tt>**name**</tt> &raquo; single word lowercase and short - how your peers call you
-- <tt>**email**</tt> &raquo; email address (validation scheduled for end of March 2018)
-- <tt>**domain**</tt> &raquo; **joe@home** if single or a team like it-dept@ibm.com
-- <tt>**store**</tt> &raquo; a Git project URL to hold your encrypted secret material
+## open an envelope | put secrets | read
 
-### opensecret | Create Keys
+- <tt>**ops open email.accounts joe@gmail.com**</tt>
+- <tt>**ops put username joebloggs**</tt>
+- <tt>**ops put question "Mothers Maiden Name"**</tt>
+- <tt>**ops put answer "Rumpelstiltskin"**</tt>
+- <tt>**ops input password**</tt>
+- <tt>**ops tell**</tt>
 
-Init(ialize) creates an uncrackable **8192 bit private/public key pair**, locked down with an amalgamated (human and machine generated) password.
+**What happened?** Look in the configured folder and you'll see some breadcrumbs and your first envelope. What happened was
 
-    $ opensecret init
+- the "emal.accounts" envelope is created for joe@gmail.com
+- the username and a memorable question are put in
+- **ops input password** securely collects the password
+- **ops tell** outputs all the data at the opened path
 
-Or you can enter the password on the command line.
-
-    $ opensecret init --password="sEeKr33tp4$$w@RD"
+Let's put data for the next email account into the same "email.acocunts" envelope.
 
+- <tt>**ops open email.accounts joe@yahoo.com**</tt>
+- <tt>**ops put username joey**</tt>
+- <tt>**ops input secret**</tt>
+- <tt>**ops tell**</tt>
 
 ### opensecret | All Done!
 
-**opensecret is configured!** Before locking and unlocking sensitive data let's ask ***"How can Susan <tt>steal</tt> Joe's secrets?*** Well, she would need to
-
-- **acquire** his USB drive key
-- *requisition* his laptop, crack the disk encryption and assail the login password
-- convince Joe that **revealing his password is the painless route, then
-- break into the backend store (AWS S3, GitHub, Google Drive, SSH)
-
-It's simple for Joe but nigh impossible for Susan. That's why you need a USB key drive, an offsite storage solution and an encrypted drive.
-
-Your ability to access your own secrets (even after disaster scenarios) is as important as preventing the secrets being accessed. This is why opensecret piggy backs off your (already configured) redundancy and backup solutions.
+Cracking opensecret is infeasible for anyone other than the rightful owner. Only OpenSSL implemented tried and tested cryptographic algorithms are used. Both PBKDF2 and BCrypt are used for expensive key derivation. The content is encrypted with AES (Advanced Encryption Standard) and 48 byte random keys are employed along with initialization vectors.
 
+Even with all this crypt technology it is **important** that you
 
-== Export the Session Key
+- choose a robust password of between 10 and 32 characters
+- align the number of salt derivation iteratios to your machine's resources
+- backup the domain folders in case you lose your USB drive or phone
 
-export OPS_KEY=`ops key`
+Your ability to access your own secrets (even after disaster scenarios) is as important as preventing the secrets being accessed.
 
-
-opensecret | Lock and Unlock
+opensecret | moving computer
 -----------
 
-Joe wants to lock away his wifi password.
-
-    $ opensecret init
-
-
-
-opensecret | moving to anoter computer
------------
-
-On computer where it is all working you do
-
-    $ opensecret copy config
-
-Then you take out the USB key and (many hours or even days later)
-you put it back into another computer you do
-
-    $ opensecret paste config
-
-
-
-One Lock | Two Keys
--------------------
-
-With suitcases, the key that locks the suitcase also opens it.
-
-In cryptography - you have two keys. You give out your public key and anyone can lock any suitcase (of goodies) with your public key. Once done, that suitcase can only be opened with the other key, your private key. opensecret creates an 8192 bit private key which is simply uncrackable.
-
-The safest place to put your private key is on a USB key drive which you carry around with your real keys. And to top it all - a password that only you know is used to lock your private key.
-
-For scripts that cannot stop and wait for user input - keys can optionally be created with a password given at the command line.
-
-    $ opensecret init --password="p455w0rd.!0NDUN"
-
-The Encryption Strategy
------------------------
-
-opensecret uses a symmetric key to perform the initial encryption of the data, followed by an asymmetric public key that encrypts the result.
-
-The encryption key itself is then locked down by the public key which is then thrown away. The file on the backend store is the doubly encrypted secret.
-
-A corresponding file appears on the front end (usb drive) store afer encryption by the master public key. This bundle (decryptable by the master private key) is an amalgamation of the
-
-- private key (to unlock the first layer of 1 secret and its encryption key)
-- the encrypted encryption key (unlockable by the aforementioned private key)
-- technical specification of the encryption algorithm plus settings
-
-The benefits of this strategy can now be assessed. First off, is the 3 isolated stores that are created.
-
+We travel between laptops, desktops, virtual machines and even docker containers. Always run init the first time you use a domain on a different computer.
 
-### The 3 Isolated (Worthless) Stores
-
-There is a grand design behind this mesh of keys, cipher text and symmetricity. The theoretical underpinning
-of opensecret is predicated on a tri-store security solution.
-
-**What is tri-store?** Use opensecret and you get 3 isolated (and individually worthless) information stores.
-
-- a backend store of doubly encrypted secrets
-- a middle store of doubly encrypted keys
-- a front end of encrypted master key (on USB), human password (in brain) and encrypted machine password (in machine)
-
-You can think of opensecret as a reference open source implementation of the tri-store concept.
-
-#### Sending a Wifi Password
-
-With the **one password culture**, just one password gives you access to everything. I can't send a Wifi password (which is gold dust to hackers) securely. I have to login (potentially exposing every secret) - copy and paste the Wifi password and then email it - even if I encrypt it I am still sending the ciphertext and then they key.
-
-
-#### benefits of a tri-store solution
-
-Think of your doubly encrypted ciphertext as the backend, the doubly encrypted keys as the middle and then the logical group of the master key (on USB), human password (in brain) and encrypted machine password (on machine).
+    $ gem install opensecret
+    $ export OPEN_SESSION_TOKEN=`ops token`    # setup a shell session variable
+    $ ops init joe@abc /home/joe/credentials   # initialize a secrets domain
+    $ ops login joe@abc                        # login to the new domain
 
-- you can transport and/or share secrets by sending the keys (not the backend material)
-- you can rotate your master key and passwords (again - no touching or accessing the backend)
-- you can (and should) assign separate (off-machine) stores for the middle and backend
-- you can select different local or cloud based storage locations for middle and backend stores
-- you can safely backup stores - and with Git you get this (and rollbacks) for no extra effort
-- you can invalidate, expire and revoke secrets by interacting with just the middle tier
-- when a secret is read - it is locked up again with new keys giving you a read audit trail
+Run all four commands the first time. Then simply run the second and fourth commands whenever you open a new shell to interact with opensecret.
 
-#### the no-go no-clouds mantra
+## the no-go no-clouds mantra
 
-opensecret is designed to operate in highly secure locked down environments in which external access is not just constrained - it is non-existent.
+opensecret is designed to operate in highly secure locked down environments in which external access is not just constrained - **it is non-existent**.
 
-opensecret does not contact nor talk to anything external. It never asks (nor needs to know) the credentials for accessing your stores - this means it compliments your storage security be it S3, Google Drive, databases, VPN, Git and even email/pop3 solutions.
+opensecret does not contact nor talk to anything external. It never asks (nor needs to know) the credentials for accessing your stores - this means it compliments your storage security be it S3, Google Drive, Redis, Git and even email/pop3 solutions.
 
-#### the encrypted at rest mantra
+## the encrypted at rest mantra
 
 The ability to read data from drives (after the fact and) after deletion means **nothing unencrypted** should be put on any drive (including usb keys).
 
 
-#### easy adoption of new algorithms
-
-You can configure the algorithm (or algorithms) and implementation used and this information is encrypted within the middle tier store.
-
-Attacks usually target particular algorithms so putting this information away (or even randomly selecting from a pool of algorithms) - all adds to the worthlessness of the backend cipher text store.
-
-Algorithms can also be selected based on encryption targets like
-
-- binary files
-- large text files or
-- small 4 digit keys (like pin numbers)
-
-Not only do no two pieces of encrypted material share encryption keys, they also need not share encryption algorithms (and remember - they are doubly encrypted).
-
-
-
 opensecret configuration
 ------------------------
 
@@ -203,33 +112,8 @@ The planned list of backend storage systems (each onlined with a plugin), is
 
 Access management is configured EXTERNAL to opensecret. Opensecret simply piggybacks the network transport if authorization is granted.
 
-How to Join a Domain
---------------------
 
-- opensecret will loop encrypting your public key's fingerprint with the public keys of present members
-- when they interact opensecret will ask if they trust the new id/email and key
-- if they say yes the fingerprint is imported and held with id/name
-- ongoing domainwide checks flag up public key / fingerprint mismatches
-- if keys are removed or updated similar questions are asked.
-
-Why Beg for Secrets?
---------------------
-
-Why beg for a secret - why not just tell someone it?
-
-It is much more secure to beg for a secret than just have someone reveal it. When you beg for a secret - you are sending an encryption key to a single person who must possess the private key and they send back the secret encrypted with both your specific public key and the encryption key that originated from you.
-
-Any hijacker will need access to a great many things and be very precise with their timing in order to serrupticiously subvert the system.
-
-
-Git | S3 or ... | Which Backend Storage?
-----------------------------------------
-
-If you have a choice and would like to know the pros and cons of one of the many backend storage options then visit the opensecret.io website.
-
-
-
-### opensecret | Summary
+## opensecret | Summary
 
 You can use opensecret alone or you can use it to share secrets with colleagues, friends and family, even machines.
 
@@ -238,7 +122,6 @@ opensecret is simple and holistically secure. *Simple* means less mistakes, less
 Every domain is tied to backend storage which is accessible by you and others in your domain. You can use Git, S3, a networked filesystem or shared drive, a SSH accessible filesystem and soon, free storage from <tt>opensecret.io</tt>
 
 
-
 ### Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
@@ -249,6 +132,20 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/opensecret. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
 
+## How to Uninstall OpenSecret
+
+Look to see where it is installed.
+
+``` bash
+ls -lah /var/lib/gems/2.5.0/gems/
+gem uninstall opensecret
+```
+
+If more than one version is installed you will be prompted to select the ones to delete.
+
+You will also be asked whether the **opensecret executables** (which are **ops** and **opensecret**) should be removed. If you say yes they are removed from **/usr/local/bin**
+
+
 License
 -------
 

data/bin/opensecret

@@ -1,5 +1,5 @@
 #!/usr/bin/env ruby
  
-require 'interpreter'
+require 'interprete'
 
-Interpreter.start(ARGV)
+Interprete.start(ARGV)

data/bin/ops

@@ -1,5 +1,20 @@
 #!/usr/bin/env ruby
  
-require 'interpreter'
+require 'interprete'
  
-Interpreter.start(ARGV)
+Interprete.start(ARGV)
+
+
+  # -- -------------------------- -- #
+  # -- Other names aside from ops -- #
+  # -- -------------------------- -- #
+  #   stash
+  #   keep
+  #   safe
+  #   box
+  #   drop
+  #   bag
+  #   db
+  #   devops
+  #   hold (of a ship)
+  # -- -------------------------- -- #

data/lib/extension/string.rb

@@ -187,46 +187,44 @@ class String
   end
 
 
-  # Get the text [in between] this and that delimeter [exclusively].
+  # Get the text [in between] this and that delimiter [exclusively].
   # Exclusively means the returned text [does not] include either of
-  # the matched delimeters (although an unmatched instance of [this]
-  # delimeter may appear in the in-between text).
+  # the matched delimiters (although an unmatched instance of [this]
+  # delimiter may appear in the in-between text).
   #
   # ### Multiple Delimiters
   #
   # When multiple delimiters exist, the text returned is in between the
   #
-  # - first occurrence of [this] delimeter AND the
-  # - 1st occurrence of [that] delimeter [AFTER] the 1st delimiter
+  # - first occurrence of [this] delimiter AND the
+  # - 1st occurrence of [that] delimiter [AFTER] the 1st delimiter
   #
   # Instances of [that] delimiter occurring before [this] are ignored.
-  # The text could contain [this] delimeter instances but is guaranteed
-  # not to contain a [that] delimeter.
+  # The text could contain [this] delimiter instances but is guaranteed
+  # not to contain a [that] delimiter.
   #
   # @throw an exception (error) will be thrown if
   #
   # - any nil (or empties) exist in the input parameters
-  # - **this** delimeter does not appear in the in_string
-  # - **that** delimeter does not appear after [this] one
+  # - **this** delimiter does not appear in the in_string
+  # - **that** delimiter does not appear after [this] one
   #
-  # @param this_delimeter [String] begin delimeter (not included in returned string)
-  # @param that_delimeter [String] end delimeter (not included in returned string)
+  # @param this_delimiter [String] begin delimiter (not included in returned string)
+  # @param that_delimiter [String] end delimiter (not included in returned string)
   #
   # @return [String] the text in between (excluding) the two parameter delimiters
-  def in_between this_delimeter, that_delimeter
+  def in_between this_delimiter, that_delimiter
 
     raise ArgumentError, "This string is NIL or empty." if self.nil? || self.empty?
     raise ArgumentError, "Begin delimiter is NIL or empty." if this_delimiter.nil? || this_delimiter.empty?
     raise ArgumentError, "End delimiter is NIL or empty." if that_delimiter.nil? || that_delimiter.empty?
     
     scanner_1 = StringScanner.new self
-    scanner_1.scan_until /#{this_delimeter}/
+    scanner_1.scan_until /#{this_delimiter}/
     scanner_2 = StringScanner.new scanner_1.post_match
-    scanner_2.scan_until /#{that_delimeter}/
+    scanner_2.scan_until /#{that_delimiter}/
 
     in_between_text = scanner_2.pre_match.strip
-    log.info(ere){ in_between_text }
-
     return in_between_text
 
   end

data/lib/{interpreter.rb → interprete.rb}

@@ -29,7 +29,7 @@ OpenSession::RecursivelyRequire.now( __FILE__ )
 # - ensure that the parameter values are in range
 # - delegate processing to the registered handlers
 #
-class Interpreter < Thor
+class Interprete < Thor
 
   log.info(x) {"opensecret session initiated at [#{OpenSession::Stamp.yyjjj_hhmm_sst}]." }
 
@@ -39,7 +39,7 @@ class Interpreter < Thor
   class_option :debug, :type => :boolean
 
   # Description of the init configuration call.
-  desc "init <domain_name>, <base_path>", "initialize domain with (optional) frontend path"
+  desc "init <domain_name>, <base_path>", "initialize domain with keystore directory"
 
   # If confident that command history cannot be exploited to gain the
   # human password or if the agent running opensecret is itself a script,
@@ -60,52 +60,51 @@ class Interpreter < Thor
   end
 
 
-  # Description of the seal use case command line call.
-  desc "seal", "Seal away the (secret stuffed) envelope into key and crypt stores."
-
-  # Seal away the (secret stuffed) envelope into key and crypt stores.
-  def seal
-    OpenSecret::Seal.new.flow_of_events
-  end
-
-
-  # Description of the begin use case command line call.
-  desc "begin", "Begin interacting with your opensecret database."
+  # Description of the login use case command line call.
+  desc "login <domain_name>", "Login to an application domain."
 
   # If confident that command history cannot be exploited to gain the
   # human password or if the agent running opensecret is itself a script,
   # the <tt>with</tt> option can be used to convey the password.
   option :with
 
-  # Begin interacting with your opensecret database.
-  def begin
-    begin_uc = OpenSecret::Begin.new
-    begin_uc.master_p4ss = options[:with] if options[:with]
-    begin_uc.flow_of_events
+  # Login in order to securely interact with your data.
+  # @param domain_name [String] the domain the software operates under
+  def login( domain_name = nil )
+    login_uc = OpenSecret::Login.new
+    login_uc.domain_name = domain_name unless domain_name.nil?
+    login_uc.master_p4ss = options[:with] if options[:with]
+    login_uc.flow_of_events
   end
 
 
-  # Description of the opensecret key use case.
-  desc "key", "Produce an encrypted session key tied to the workstation and shell environment."
 
-  # The<b>key</b> use cases prints out an encrypted session key tied
+  # Description of the opensecret token use case.
+  desc "token", "Produce an encrypted session token tied to the workstation and shell environment."
+
+  # The<b>token</b> use cases prints out an encrypted session token tied
   # to the workstation and shell environment.
-  def key
-    OpenSecret::Key.new.flow_of_events
+  def token
+    OpenSecret::Token.new.flow_of_events
   end
 
 
+
   # Description of the open use case command.
-  desc "open OPEN_PATH", "OPEN_PATH to envelope of secrets to stuff and then lock."
+  desc "open ENVELOPE_PATH", "KEY_PATH open a key path within the specified envelope."
 
-  # Open up a conduit from which we can add, subtract, update and list secrets
-  # before they are committed (and pushed) into permanent locked storage.
+  # Open up a conduit (path) to the place where we can issue read, create, update,
+  # and destroy commands.
   #
-  # @param open_path [String] the path to USB key for storing encrypted keys
-  def open open_path
+  # @param env_path [String]
+  #    relative path to the obfuscated envelope
+  # @param key_path [String]
+  #    path in envelope to the point of interest
+  def open env_path, key_path
 
     open_uc = OpenSecret::Open.new
-    open_uc.open_path = open_path
+    open_uc.env_path = env_path
+    open_uc.key_path = key_path
     open_uc.flow_of_events
 
   end
@@ -162,4 +161,29 @@ class Interpreter < Thor
   end
 
 
+  # Description of the read secret command.
+  desc "read", "read and show secrets at the opened path."
+
+  # Read the secrets at the opened path. These secrets
+  # are simply written out to the shell console.
+  def read
+
+    read_uc = OpenSecret::Read.new
+    read_uc.flow_of_events
+
+  end
+
+
+  # Description of the print identifier command.
+  desc "id", "print multiple formats of the current timestamp."
+
+  # Print the multiple formats of the current timestamp.
+  def id
+
+    id_uc = OpenSecret::Id.new
+    id_uc.flow_of_events
+
+  end
+
+
 end