confidant

The confidant command provides a utility for conveniently operating on file-based secret store. It is often used in conjunction logged to encrypt payloads as a pre-stage, or decrypt as a post-stage. No assumption is made regarding the nature of a payload beyond it being encrypted using streambed crypto functions.

Running with an example encrypt followed by a decrypt

First get the executable:

cargo install streambed-confidant-cli

...or build it from this repo:

cargo build --bin confidant --release

...and make a build available on the PATH (only for cargo build and just once per shell session):

export PATH="$PWD/target/release":$PATH

Before you can use confidant, you must provide it with a root secret and a "secret id" (password) to authenticate the session. Here's an example with some dummy data:

echo "1800af9b273e4b9ea71ec723426933a4" > /tmp/root-secret

We also need to create a directory for confidant to read and write its secrets. A security feature of the confidant library is that the directory must have a permission of 600 for the owner user. ACLs should then be used to control access for individual processes. Here's how the directory can be created:

mkdir /tmp/confidant
chmod 700 /tmp/confidant

You would normally source the above secrets from your production system, preferably without them leaving your production system.

Given the root secret, encrypt some data :

echo '{"value":"SGkgdGhlcmU="}' | \
  confidant --root-path=/tmp/confidant encrypt --file - --path="default/my-secret-path"

...which would output:

{"value":"EZy4HLnFC4c/W63Qtp288WWFj8U="}

That value is now encrypted with a salt.

We can also decrypt in a similar fashion:

echo '{"value":"EZy4HLnFC4c/W63Qtp288WWFj8U="}' | \
  confidant --root-path=/tmp/confidant decrypt --file - --path="default/my-secret-path"

...which will yield the original BASE64 value that we encrypted.

Use --help to discover all of the options.