yasec

Documentation

Overview

Package yasec helps to keep secrets in config files as secret as possible. (Needs to be audited)

When ‘yasec’ is compiled with the build tag ‘yasec_dev’, secrets can also be specified in plain text in the configuration file. To do this, the string in the configuration file must begin with the character ‘=’. Secrets read in this way are not protected in main memory. A program compiled in this way writes a warning to stderr during initialization.

On demand reading of the master password is disabled for secrets when read from plain text (See Config).

Index

• func PromptNewPassword(p1, p2 string) (*memguard.Enclave, error)
• func PromptPassword(p string) (*memguard.Enclave, error)
• func ReadPassword() (*memguard.Enclave, error)
• type Config
  • func NewConfig(key *memguard.Enclave) *Config
  • func (cfg *Config) Set(key *memguard.Enclave)
  • func (cfg *Config) SetFromPrompt(text string, salt []byte) error
  • func (cfg *Config) SetFromUnixSocket(path string, salt []byte) error
  • func (cfg *Config) SetPassword(passwd, salt []byte)
  • func (cfg *Config) SetPasswordFrom(pwr Passworder, salt []byte) error
  • func (cfg *Config) SetPasswordString(passwd string, salt []byte)
• type EmptySecret
  • func (EmptySecret) Error() string
• type FDPassword
  • func (pw FDPassword) Password() (*memguard.Enclave, error)
• type PasswordFunc
  • func (f PasswordFunc) Password() (*memguard.Enclave, error)
• type PasswordPrompt
  • func (pw PasswordPrompt) Password() (*memguard.Enclave, error)
• type Passworder
• type PasswordsDiffer
  • func (PasswordsDiffer) Error() string
• type Secret
  • func (sec Secret) Empty() bool
  • func (sec Secret) Equal(data []byte) (bool, error)
  • func (sec Secret) EqualString(s string) (bool, error)
  • func (sec Secret) MarshalBinary() (data []byte, err error)
  • func (sec Secret) MarshalText() (text []byte, err error)
  • func (sec *Secret) MergeDaQ(m *daq.Merge, add any) error
  • func (sec Secret) Open() (*memguard.LockedBuffer, error)
  • func (sec Secret) Protected() bool
  • func (sec *Secret) Set(buf *memguard.LockedBuffer) error
  • func (sec *Secret) UnmarshalBinary(data []byte) error
  • func (sec *Secret) UnmarshalText(text []byte) error
• type UnixSocketPassword
  • func (pw UnixSocketPassword) Password() (*memguard.Enclave, error)

Examples

• Secret

Functions

func PromptNewPassword

func PromptNewPassword(p1, p2 string) (*memguard.Enclave, error)

func PromptPassword

func PromptPassword(p string) (*memguard.Enclave, error)

func ReadPassword

func ReadPassword() (*memguard.Enclave, error)

Types

type Config

type Config struct {
	GetPassword Passworder
	KDFSalt     []byte
	// contains filtered or unexported fields
}

Config holds the master password that is used to decrypt a Secret when it opened for actual use.

var (
	// DefaultConfig config is used to access a [Secret] when that secret has no
	// explicit Config.
	DefaultConfig Config

	// The default salt used when calling the KDF for [Config] password.
	DefaultSalt []byte
)

func NewConfig

func NewConfig(key *memguard.Enclave) *Config

func (*Config) Set

func (cfg *Config) Set(key *memguard.Enclave)

func (*Config) SetFromPrompt

func (cfg *Config) SetFromPrompt(text string, salt []byte) error

func (*Config) SetFromUnixSocket

func (cfg *Config) SetFromUnixSocket(path string, salt []byte) error

func (*Config) SetPassword

func (cfg *Config) SetPassword(passwd, salt []byte)

func (*Config) SetPasswordFrom

func (cfg *Config) SetPasswordFrom(pwr Passworder, salt []byte) error

func (*Config) SetPasswordString

func (cfg *Config) SetPasswordString(passwd string, salt []byte)

type EmptySecret

type EmptySecret struct{}

func (EmptySecret) Error

func (EmptySecret) Error() string

type FDPassword

type FDPassword uintptr

func (FDPassword) Password

func (pw FDPassword) Password() (*memguard.Enclave, error)

type PasswordFunc

type PasswordFunc func() (*memguard.Enclave, error)

func (PasswordFunc) Password

func (f PasswordFunc) Password() (*memguard.Enclave, error)

type PasswordPrompt

type PasswordPrompt string

PasswordPrompt is a Passworder that reads a password directly from a terminal without echoing the user input. One can use e.g. term.IsTerminal() to check if password can be provided this way.

func (PasswordPrompt) Password

func (pw PasswordPrompt) Password() (*memguard.Enclave, error)

type Passworder

type Passworder interface {
	Password() (*memguard.Enclave, error)
}

Passworders are used to supply a master password for Config (see also Config.SetPasswordFrom).

type PasswordsDiffer

type PasswordsDiffer struct{}

func (PasswordsDiffer) Error

func (PasswordsDiffer) Error() string

type Secret

type Secret struct {
	Config *Config
	// contains filtered or unexported fields
}

Example

key := memguard.NewBufferFromBytes([]byte{
	0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
})
cfg := NewConfig(key.Seal())
secret := Secret{Config: cfg}
data := must.Ret(memguard.NewBufferFromEntireReader(strings.NewReader("foo bar baz")))
secret.Set(data)
data.Destroy()

data = must.Ret(secret.Open())
defer data.Destroy()
fmt.Println(data.String())

Output:
foo bar baz

func (Secret) Empty

func (sec Secret) Empty() bool

func (Secret) Equal

func (sec Secret) Equal(data []byte) (bool, error)

func (Secret) EqualString

func (sec Secret) EqualString(s string) (bool, error)

func (Secret) MarshalBinary

func (sec Secret) MarshalBinary() (data []byte, err error)

func (Secret) MarshalText

func (sec Secret) MarshalText() (text []byte, err error)

func (*Secret) MergeDaQ

func (sec *Secret) MergeDaQ(m *daq.Merge, add any) error

func (Secret) Open

func (sec Secret) Open() (*memguard.LockedBuffer, error)

func (Secret) Protected

func (sec Secret) Protected() bool

func (*Secret) Set

func (sec *Secret) Set(buf *memguard.LockedBuffer) error

func (*Secret) UnmarshalBinary

func (sec *Secret) UnmarshalBinary(data []byte) error

func (*Secret) UnmarshalText

func (sec *Secret) UnmarshalText(text []byte) error

type UnixSocketPassword

type UnixSocketPassword string

UnixSocketPassword is a Passworder that reads the password from a temporary unix domain socket that is closed and deleted after the password has been read. Note that the unix domain socket can be intercepted by other processes which also it vulnerable for a short period of time.

For example, if you start a programm with nohup, you can use this method to provide the password without including it in argv[] or envp[] (C style). Both are considered insecure.

func (UnixSocketPassword) Password

func (pw UnixSocketPassword) Password() (*memguard.Enclave, error)