keep

README

keep

keep is a simple password manager that is built on top of openPGP. Each account is save in a text file that contains 3 elements separated by a \n:

• Password
• Username
• Notes

The filename is the account name.

Notes : You can stop using keep and leave with your data when ever you want. Browse your files (accounts) :

• ls ~/.keep/passwords/

Display contents manually:

• gpg -d ~/.keep/passwords/example.com

Keep let you manage multiple profiles. A Profile is composed of :

• A directory where the passwords are saved. The directory can be shared between users. The username, note and password are safely encrypted but the account name is visible by anyone that has access to the shared folder.
• RecipientKeyIds A space separated list of GPG Key Id that the account should be encrypted to.

Install

Make sure you have a GnuPG key pair: GnuPG HOWTO. GnuPG is secure, open, multi-platform, and will probably be around forever. Can you say the same thing about the way you store your passwords currently ? You can go get keep to install it in $GOPATH/bin

go get github.com/yml/keep/cmd/...

Usage

keep has 3 main subcommands { read | list | add } that let you manage your passwords.

keep --help
keep password manager

Usage:
        keep read [options] <file> [--print]
        keep list [options] [<file>]
        keep add [options]

Options:
        -r --recipients=KEYS   List of key ids the message should be encypted
        -d --dir=PATH          Account Directory
        -p --profile=NAME      Profile name
        -c --clipboard         Copy password to the clipboard

When you first use keep a configuration file is created in $HOME/.keep/keep.conf. This JSON file contains the list of profiles:

cat ~/.keep/keep.conf
[
    {
        "Name": "yml",
        "SecringDir": "/home/yml/.gnupg/secring.gpg",
        "PubringDir": "/home/yml/.gnupg/pubring.gpg",
        "AccountDir": "/home/yml/.keep/passwords",
        "RecipientKeyIds": "6A8D785C",
        "SignerKeyID": "6A8D785C"
    },
    {
        "Name": "company",
        "SecringDir": "/home/yml/.gnupg/secring.gpg",
        "PubringDir": "/home/yml/.gnupg/pubring.gpg",
        "AccountDir": "/home/yml/Dropbox/company/secrets/passwords",
        "RecipientKeyIds": "6A8D785C <add the list of space separated key>"
        "SignerKeyID": "6A8D785C"
    },
    {
        "Name": "test",
        "SecringDir": "/home/yml/.gnupg/secring.gpg",
        "PubringDir": "/home/yml/.gnupg/pubring.gpg",
        "AccountDir": "/home/yml/gopath/src/github.com/yml/keep/test_data/passwords",
        "RecipientKeyIds": "6A8D785C",
        "SignerKeyID": "6A8D785C"
    }

]

Test

test_data contains an armored private key that should be imported in your pubring and secring.

gpg --allow-secret-key-import --import test_data/6A8D785C.gpg.asc

You can run the test suite with the following command:

cd $GOPATH/github.com/yml/keep
GPGKEY=6A8D785C GPGPASSPHRASE=keep go test --race --cover -v .

You can also interactively test some test_data entry.

keep -p test read test 1 --print

Credits

keep is a liberal reimplementation in GO of kip developed by Graham King. kip is a python wrapper on top of GnuPG where keep on the other hand is a native GO implementation on build on top of github.com/golang/crypto.

This project takes advantage of the following "vendored" packages :

• github.com/atotto/clipboard
• github.com/docopt/docopt-go
• github.com/jcmdev0/gpgagent
• golang.org/x/crypto/cast5
• golang.org/x/crypto/openpgp
• golang.org/x/crypto/openpgp/armor
• golang.org/x/crypto/openpgp/elgamal
• golang.org/x/crypto/openpgp/errors
• golang.org/x/crypto/openpgp/packet
• golang.org/x/crypto/openpgp/s2k
• golang.org/x/crypto/ssh/terminal
• golang.org/x/sys/unix

Documentation

Index

• func GetConfigPaths() (string, string)
• func GuessPromptFunction() openpgp.PromptFunction
• func NewPassword(length int) ([]byte, error)
• type Account
  • func NewAccountFromConsole(conf *Config) (*Account, error)
  • func NewAccountFromFile(conf *Config, fname string) (*Account, error)
  • func NewAccountFromReader(conf *Config, name string, r io.Reader) (*Account, error)
  • func (a Account) Bytes() []byte
  • func (a *Account) Encrypt() ([]byte, error)
  • func (a *Account) Path() string
• type Config
  • func NewConfig(p *Profile) *Config
  • func (c *Config) EntityListRecipients() (openpgp.EntityList, error)
  • func (c *Config) EntityListWithSecretKey() (openpgp.EntityList, error)
  • func (c *Config) EntitySigner() (*openpgp.Entity, error)
  • func (c *Config) ListAccountFiles(fileSubStr string) ([]os.FileInfo, error)
• type Profile
  • func DefaultProfile() *Profile
• type ProfileStore
  • func LoadProfileStore() (ProfileStore, error)

Functions

func GetConfigPaths

func GetConfigPaths() (string, string)

GetConfigPaths returns the paths for the contifuration file and the accountDir.

func GuessPromptFunction

func GuessPromptFunction() openpgp.PromptFunction

GuessPromptFunction is a function that returns an openpgp.PromptFunction well suited for the context.

func NewPassword

func NewPassword(length int) ([]byte, error)

NewPassword return a randomly generated password of the requested length

Types

type Account

type Account struct {
	Name     string
	Username string
	Password string
	Notes    string

	// The following fields are valued when the account is read.
	IsSigned bool
	SignedBy *openpgp.Key // the key of the signer, if available
	// contains filtered or unexported fields
}

Account represents an Account

func NewAccountFromConsole

func NewAccountFromConsole(conf *Config) (*Account, error)

NewAccountFromConsole returns an Account built with the elements collected by interacting with the user.

func NewAccountFromFile

func NewAccountFromFile(conf *Config, fname string) (*Account, error)

NewAccountFromFile returns an Account as described by a file in the accountDir.

func NewAccountFromReader

func NewAccountFromReader(conf *Config, name string, r io.Reader) (*Account, error)

NewAccountFromReader returns an account with the provided element. The reader is expected to returns bytes int the appropriate format :

• []byte(password\nusername\nnotes)

func (Account) Bytes

func (a Account) Bytes() []byte

Bytes returns a slice of byte representing the account.

func (*Account) Encrypt

func (a *Account) Encrypt() ([]byte, error)

Encrypt returns the encrypted byte slice for an account.

func (*Account) Path

func (a *Account) Path() string

Path returns the theoretical path where the account file is.

type Config

type Config struct {
	SecringDir      string
	PubringDir      string
	AccountDir      string
	RecipientKeyIds string
	SignerKeyID     string
	PromptFunction  openpgp.PromptFunction
}

Config represents the configuration required to work with GPG.

func NewConfig

func NewConfig(p *Profile) *Config

NewConfig returns an initialized Config with the information copied from a Profile. If nil Profile is passed we build one from DefaultProfile.

func (*Config) EntityListRecipients

func (c *Config) EntityListRecipients() (openpgp.EntityList, error)

EntityListRecipients returns the openpgp.EntityList corresponding to the RecipientKeyIds from the Config.

func (*Config) EntityListWithSecretKey

func (c *Config) EntityListWithSecretKey() (openpgp.EntityList, error)

EntityListWithSecretKey returns the openpgp.EntityList contains in Secring.

func (*Config) EntitySigner

func (c *Config) EntitySigner() (*openpgp.Entity, error)

EntitySigner returns an Entity with a decrypted Private Key.

func (*Config) ListAccountFiles

func (c *Config) ListAccountFiles(fileSubStr string) ([]os.FileInfo, error)

ListAccountFiles returns the list of Files stored in the AccountDir. The list is filtered in a case in sensitive way.

type Profile

type Profile struct {
	Name            string
	SecringDir      string
	PubringDir      string
	AccountDir      string
	RecipientKeyIds string
	SignerKeyID     string
}

Profile represents the information that can be persited to disk of a Config.

func DefaultProfile

func DefaultProfile() *Profile

DefaultProfile returns the a Profile with customized information for a user.

type ProfileStore

type ProfileStore []Profile

ProfileStore is type alias that we used to store Profile in the configuration file.

func LoadProfileStore

func LoadProfileStore() (ProfileStore, error)

LoadProfileStore returns the ProfileStore with the information found in the configuration file.