217 lines
9.6 KiB
Markdown
217 lines
9.6 KiB
Markdown
# tiny-encrypt-rs
|
|
|
|
> [!IMPORTANT]
|
|
> To use tiny-encrypt, a Yubikey(https://www.yubico.com/products/) or MacBook with Secure Enclave get the
|
|
> best security effect, the key MUST support PIV or OpenPGP.
|
|
|
|
|
|
|
|
|
|
Tiny Encrypt written in Rust Programming Language
|
|
|
|
Specification: [Tiny Encrypt Spec V1.1](https://github.com/OpenWebStandard/tiny-encrypt-format-spec/blob/main/TinyEncryptSpecv1.1.md)
|
|
|
|
> Tiny encrypt rs is a Rust implementation of Tiny encrypt java https://git.hatter.ink/hatter/tiny-encrypt-java <br>
|
|
> Tiny encrypt spec see: https://github.com/OpenWebStandard/tiny-encrypt-format-spec
|
|
|
|
Repository address: https://git.hatter.ink/hatter/tiny-encrypt-rs mirror https://github.com/jht5945/tiny-encrypt-rs
|
|
|
|
Set default encryption algorithm:
|
|
|
|
```shell
|
|
export TINY_ENCRYPT_DEFAULT_ALGORITHM='AES' # or CHACHA20
|
|
```
|
|
|
|
Compile only encrypt:
|
|
|
|
```shell
|
|
cargo build --release --no-default-features
|
|
```
|
|
|
|
Install from git:
|
|
|
|
```shell
|
|
cargo install --git https://git.hatter.ink/hatter/tiny-encrypt-rs.git --features full-features
|
|
```
|
|
|
|
Edit encrypted file:
|
|
|
|
```shell
|
|
tiny-encrypt decrypt --edit-file sample.txt.tinyenc
|
|
```
|
|
|
|
Read environment `EDITOR` or `SECURE_EDITOR` to edit file, `SECURE_EDITOR` write encrypted file to temp file.
|
|
|
|
Secure editor command format:
|
|
|
|
```shell
|
|
$SECURE_EDITOR <temp-file-name> "aes-256-gcm" <temp-key-hex> <temp-nonce-hex>
|
|
```
|
|
|
|
<br>
|
|
|
|
Encrypt config `~/.tinyencrypt/config-rs.json`:
|
|
|
|
```json
|
|
{
|
|
"environment": {
|
|
"TINY_ENCRYPT_DEFAULT_ALGORITHM": "AES or CHACHA20"
|
|
},
|
|
"namespaces": {
|
|
"name": "/Users/example/.name"
|
|
},
|
|
"envelops": [
|
|
{
|
|
"type": "pgp-rsa",
|
|
"kid": "KID-1",
|
|
"desc": "this is key 001",
|
|
"publicPart": "----- BEGIN PUBLIC KEY ..."
|
|
},
|
|
{
|
|
"type": "piv-p256",
|
|
"kid": "KID-2",
|
|
"desc": "this is key 002",
|
|
"publicPart": "04..."
|
|
}
|
|
],
|
|
"profiles": {
|
|
"default": [
|
|
"KID-1",
|
|
"KID-2"
|
|
],
|
|
"l2,leve2": [
|
|
"KID-2"
|
|
]
|
|
}
|
|
}
|
|
```
|
|
|
|
<br>
|
|
|
|
Kyber1024 usage:
|
|
Generate `static-kyber1024` keypair:
|
|
|
|
```shell
|
|
$ tiny-encrypt -K -a kyber1024 -n keyname
|
|
[OK ] Keychain name: keyname
|
|
[OK ] Public key : a731b5032194c3d2ad01f36d64e859ca9738595c21aa19c852dac22f4...
|
|
[INFO ] Config envelop:
|
|
{
|
|
"type": "static-kyber1024",
|
|
"sid": "keyname",
|
|
"kid": "keychain:a731b5032194c3d2ad01f36d64e859ca9738595c21aa19c852dac22f411036c7",
|
|
"desc": "Keychain static",
|
|
"args": [
|
|
"keychain::tiny-encrypt:keyname"
|
|
],
|
|
"publicPart": "a731b5032194c3d2ad01f36d64e859ca9738595c21aa19c852dac22f411036c..."
|
|
}
|
|
```
|
|
|
|
<br>
|
|
Generate Secure Enclave keypair:
|
|
|
|
```shell
|
|
te -K -S --key-name "tes1" -E --secure-enclave-control-flag none
|
|
[INFO ] Config envelop:
|
|
{
|
|
"type": "key-p256",
|
|
"sid": "tes1",
|
|
"kid": "keychain:02c82ef4534ac0c4e27074ca75f4c5d926622fcee9f9cfccc0e85be0d5c5dc4864",
|
|
"desc": "Keychain Secure Enclave",
|
|
"args": [
|
|
"BIIBQDGCATwwgf****************************************************************AQEB"
|
|
],
|
|
"publicPart": "04c82ef4534ac0c4e27074ca75f4c5d926622fcee9f9cfccc0e85be0d5c5dc48647264ba0b272e811b3b07ca13177c89a20e71605fbf3bc2742a5cc8558e880c45",
|
|
"profiles": null
|
|
}
|
|
```
|
|
|
|
<br>
|
|
|
|
Ext keys generate via `card-cli`, e.g.
|
|
|
|
```shell
|
|
card-cli keypair-generate --type p256 --with-hmac-encrypt --json | jq .
|
|
{
|
|
"key_uri": "key://yubikey5-16138686:soft/p256::hmac_enc:5G6duDQLbZzKvAbcaEleMA:E7MFSz36l_1fBRSzxSwysQ:7calffpbc8MsIQHFY0IBYVDZI6vIicNiKExXaHKZ5fLnKCUDx9gUlQyGaSZr8Lo4X2g97yfulQjhihTk+Rxd9ZKyM1yYVv8MEylNrYutBv97x9C8Oawg6D1PjavQYa124SXQLW7oUbGf6at5bMx1EPb0RK9SL+aDg/yg76oxHW6qdyOxTuTBosEY0FGSf51FCAt2MncKf2n67hw129fD0/zZ83d+VSWOB/NPs4m0Hc3SWecXSxweN1yqXmdGlhTVdSyxghdqqys=",
|
|
"private_key_base64": "hmac_enc:5G6duDQLbZzKvAbcaEleMA:E7MFSz36l_1fBRSzxSwysQ:7calffpbc8MsIQHFY0IBYVDZI6vIicNiKExXaHKZ5fLnKCUDx9gUlQyGaSZr8Lo4X2g97yfulQjhihTk+Rxd9ZKyM1yYVv8MEylNrYutBv97x9C8Oawg6D1PjavQYa124SXQLW7oUbGf6at5bMx1EPb0RK9SL+aDg/yg76oxHW6qdyOxTuTBosEY0FGSf51FCAt2MncKf2n67hw129fD0/zZ83d+VSWOB/NPs4m0Hc3SWecXSxweN1yqXmdGlhTVdSyxghdqqys=",
|
|
"private_key_pem": "hmac_enc:RztW8_ox3nOeFkYrLNkNEA:hF9e_JAEZodkbkaIFjeA9w:PfeyYzBhzViaC/jgh5Yr9oq8WxBw8UJfzzTpmWntT30mcgwxiWtI7Q857yMCnllqrzVxi+/Nt1tgsUeiRXG/5OrbaCJuyZLv/TgSulfoSchHhEv0t0mblsFRFCCcu+6XWPmcg3IOCpZ5VlafT6Z2FSpXXxi5DBCXPEKWN+2CyG0Tl2fDxQj5yI9MGQtmLFbLuGnAVAhrwph4gajWVp6q5zU4vxd4btZFCbfQpLJU9vIp/w1HJQOW6cuLxREsidXwMxmqekHCKxwti5yif97UyH+5AAfI5fWbpp9TazPhtbFIX75f+xAONCo+wJWzTBKtyugmkjQyYTwPZnid1JrUKv4=",
|
|
"public_key_base64": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEasRLmoKUG/TKTHb8qLR+uN3KRn3IPIzXGUcBVMArgjA6Bm3CdeRgslv3kzSv0TezwOA8Rmx3yyJWhjzFfTwzig==",
|
|
"public_key_jwk": "{\"kty\":\"EC\",\"crv\":\"P-256\",\"x\":\"asRLmoKUG_TKTHb8qLR-uN3KRn3IPIzXGUcBVMArgjA\",\"y\":\"OgZtwnXkYLJb95M0r9E3s8DgPEZsd8siVoY8xX08M4o\"}",
|
|
"public_key_pem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEasRLmoKUG/TKTHb8qLR+uN3KRn3I\nPIzXGUcBVMArgjA6Bm3CdeRgslv3kzSv0TezwOA8Rmx3yyJWhjzFfTwzig==\n-----END PUBLIC KEY-----\n"
|
|
}
|
|
```
|
|
|
|
Then write file `~/.tinyencrypt/config-rs.json`.
|
|
|
|
Last, config key id to profile.
|
|
|
|
Supported PKI encryption types:
|
|
|
|
| Type | Algorithm | Description |
|
|
|------------------|---------------------|--------------------------------------------------------|
|
|
| pgp-rsa | PKCS1-v1.5 | OpenPGP Encryption Key (Previous `pgp`) |
|
|
| pgp-x25519 | ECDH(X25519) | OpenPGP Encryption Key |
|
|
| gpg | OpenPGP | GnuPG Command |
|
|
| static-x25519 | ECDH(X25519) | Key Stored in macOS Keychain Access |
|
|
| static-kyber1024 | Kyber1024 | Key Stored in macOS Keychain Access |
|
|
| piv-rsa | PKCS1-v1.5 | PIV Slot |
|
|
| piv-p256 | ECDH(secp256r1) | PIV Slot (Previous `ecdh`) |
|
|
| piv-p384 | ECDH(secp384r1) | PIV Slot (Previous `ecdh-p384`) |
|
|
| key-p256 | ECDH(secp256r1) | Key Stored in macOS Secure Enclave (using P256) |
|
|
| key-mlkem768 | ML-KEM(ML-KEM-768) | Key Stored in macOS Secure Enclave (using ML-KEM-768) |
|
|
| key-mlkem1024 | ML-KEM(ML-KEM-1024) | Key Stored in macOS Secure Enclave (using ML-KEM-1024) |
|
|
| ext-p256 | ECDH(secp256r1) | Key Protected by External Command |
|
|
| ext-p384 | ECDH(secp384r1) | Key Protected by External Command |
|
|
| ext-mlkem768 | ML-KEM(ML-KEM-768) | Key Protected by External Command |
|
|
| ext-mlkem1024 | ML-KEM(ML-KEM-1024) | Key Protected by External Command |
|
|
| ext-x25519 | ECDH(X25519) | Key Protected by External Command |
|
|
|
|
Smart Card(Yubikey) protected ECDH Encryption description as below:
|
|
|
|
```text
|
|
┌───────────────────┐ ┌───────────────────────────┐
|
|
│Tiny Encrypt │ │Smart Card (e.g. Yubikey) │
|
|
│ │ Get Public Key(P) │ │
|
|
│ │ ◄───────────────────┤ Private Key(d) │
|
|
│ │ │ P = dG │
|
|
│ │ Temp Private Key(k) │ │
|
|
└───────────────────┘ Q = kG └───────────────────────────┘
|
|
|
|
Shared Secret = kP = kdG
|
|
|
|
Store Q, Encrypt using derived key from Shared Secret
|
|
|
|
Send Q to Smart Card
|
|
───────────────────►
|
|
Shared Secret = dQ = kdG
|
|
|
|
Decrypt using derived key from restored Shared Secret
|
|
```
|
|
|
|
Environment
|
|
|
|
| KEY | Comment |
|
|
|----------------------------------|----------------------------------------------------------|
|
|
| TINY_ENCRYPT_CONFIG_FILE | Config file |
|
|
| TINY_ENCRYPT_DEFAULT_ALGORITHM | Encryption algorithm, `aes` or `chacha20` |
|
|
| TINY_ENCRYPT_DEFAULT_COMPRESS | File compress, `1` or `on`, default `false` |
|
|
| TINY_ENCRYPT_NO_PROGRESS | Do not display progress bar |
|
|
| TINY_ENCRYPT_NO_DEFAULT_PIN_HINT | Do not display default PIN hint |
|
|
| TINY_ENCRYPT_USE_DIALOGUER | Use dialoguer |
|
|
| TINY_ENCRYPT_PIN | PIV Card PIN |
|
|
| TINY_ENCRYPT_KEY_ID | Default Key ID |
|
|
| TINY_ENCRYPT_AUTO_SELECT_KEY_IDS | Auto select Key IDs |
|
|
| TINY_ENCRYPT_AUTO_COMPRESS_EXTS | Auto compress file exts |
|
|
| TINY_ENCRYPT_PIN_ENTRY | PIN entry command cli |
|
|
| TINY_ENCRYPT_EXTERNAL_COMMAND | External command cli |
|
|
| SECURE_EDITOR | Secure Editor [\[OWS RFC6\]](https://ows.hatter.in/rfc6) |
|
|
| EDITOR | Editor (Plaintext) |
|
|
|
|
Alternative environment setup:
|
|
|
|
```shell
|
|
~/.config/envs/ENV_VARIABLE_NAME <--> File Content
|
|
```
|