pass doesn't have a command to directly source contents of a stored password into shell variables. But it would be great to bring that functionality from this tool into pass.
I wish there was an alternative to GPG or at least some bare-minimum implementation with a decent API. The only "libraries" are wrappers on top of the gpg executable.
Maybe there is an alternative that I don't know of?
GPGME is a wrapper on top of the GPG executable. It also has a horrendous API. I'm still currently fighting with it just to simply encrypt/decrypt a tarball going to S3. It's really badly designed.
Yeah this is a common complaint. I don't have direct experience with NaCL/libsodium or Keyczar but check them out. Do you mean a bitstream-compatible thing, or a GPG/PGP alternative?
libsodium is pretty GPG compatible.
Diffie-Hellman key exchange function[X25519]:
int crypto_scalarmult(unsigned char q, const unsigned char n, const unsigned char p);
crypto_secretbox_easy() for both encrypting + signing in the traditional public-key fashion.
AES-256-GCM is there for symmetric sessions.
Even OTP's are supported. I don't think there's the full PKI/WoT implementation in there, at the moment, but it's definitely sufficient to do most of the heavy lifting.
(N.b. the documentation is only like 70 pages long, read the relevant sections on: sodium_memzero(), sodium_mlock(), the notes on VMs, the notes if you have swapon, the notes on disabling coredumps, don't use malloc, use sodium_malloc() (and with that, the appropriate padding precautions should be taken if you use sodium_allocarray()), and source your entropy properly. All of this is covered in the API guide. Consult it, because I'm likely misremembering one or two things.)
Reop is not really the answer, but I think it (and NaCl with it) is the best starting point for building a GPG replacement. Of course it does not fit if you need compatibility with actual GPG for some reason.
hunter2 ( https://chiselapp.com/user/rkeene/repository/hunter2/ ) does not rely on (or even directly support) GPG. It's written in mostly Tcl with some C glue to call any PKCS#11 module. I tend to use CACKey, which talks directly to my smartcard using PC/SC from pcsc-lite and performs RSA on the card itself. Hope this helps !
15 comments
[ 3.8 ms ] story [ 42.5 ms ] thread[0] https://www.passwordstore.org/
Lazy version:
EDIT: lessen <pre> widthMaybe there is an alternative that I don't know of?
https://www.gnupg.org/documentation/manuals/gpgme/
Don't look at the source code of GPG, it will give you nightmares.
crypto_secretbox_easy() for both encrypting + signing in the traditional public-key fashion. AES-256-GCM is there for symmetric sessions. Even OTP's are supported. I don't think there's the full PKI/WoT implementation in there, at the moment, but it's definitely sufficient to do most of the heavy lifting.
(N.b. the documentation is only like 70 pages long, read the relevant sections on: sodium_memzero(), sodium_mlock(), the notes on VMs, the notes if you have swapon, the notes on disabling coredumps, don't use malloc, use sodium_malloc() (and with that, the appropriate padding precautions should be taken if you use sodium_allocarray()), and source your entropy properly. All of this is covered in the API guide. Consult it, because I'm likely misremembering one or two things.)
http://www.tedunangst.com/flak/post/reop