agree
agree is a CLI tool for easily applying multi-key-turn security via Shamirs Secret Sharing.
Project state
agree is unstable.
Version semantics: ^([0-9]+\.[0-9]+\.[0-9]+)(-(alpha|beta)\.[0-9]+)?$.
Example
Split a secret into n shares (interactive)
To split a secret (file) into shares, execute one of the following examples.:
- Data is in a file (
Cargo.toml):
agree split -i -s Cargo.toml - Data is generated by an inline shell script and written to
STDOUT(this approach uses process substitution):
agree split -i -s <(printf "secret")
This command is interactive and asks the user to provide data like s hare name, file path and optional password to encrypt the share data.
Restore a secret from n shares (interactive)
In the following example, the secret was split into 2 shares. We need to provide exactly two shares in order to restore the secret and write it to STDOUT.
This command is interactive as it might prompt for the password of the share if it's share dataa is encrypted.
agree restore -i -s ./share1.file -s ./share2.file
Note that if any password is encrypted and the -i flag is not provided, the command execution will fail since no password can be prompted from the user when in non-interactive mode.
Split a secret into n shares (via blueprint)
The example below will split the secret into three shares with a restore threshold of two. Assuming the file is called blueprint.yaml, we can use the following command:
agree split -s Cargo.toml -b blueprint.yaml
threshold: 2
generate:
- path: ./test/alice.share
- path: ./test/bob.share
name: bob
encrypt: !plain example-bob
info: true
comment: example for bob
- path: ./test/charlie.share
name: charlie
encrypt: !shell printf example-charlie
The same result can be achieved using the interactive mode:
agree split -i -s Cargo.toml
Share composition
In all version, bytes [0..36) are reserved for the version ID of the archive.
In the following schematics, only the data from index [36..] is used and shifted left to index 0 for convenience.
1f2c6a6d-f711-4378-97b9-5f9e2f9f4271kldmf209fm0f944fwef98syf23f9h2fneuf2efhux...
^ -- -- VERSION ID -- -- ^ DATA =>
v0.1
v0.1 is a yaml base64 encoded YAML file. The share information can be store either in plain text or can be protected with a password. The share data is always base64 encoded when stored in the YAML field.
If encrypted with a password, a symmetric encryption algorithm with the following attributes is used (from the crate simplecrypt v 1.0.2):
/// |index |usage|
/// |-------|-----|
/// |0 - 15 |salt |
/// |16 - 39|nonce|
/// |40 - 55|mac |
/// |56 - |data |
The password to the data is hashed via argon2. The hashed password is stored alongside the encrypted data to easily identify wrong passwords when the data is decrypted.
137 Dec 29, 2022
13 Dec 29, 2022
233 Dec 17, 2022
1 Jan 8, 2022
157 Dec 8, 2022
3 May 4, 2023
![[ZenGo X]](https://avatars.githubusercontent.com/u/40664522?v=4&s=40)
61 Dec 28, 2022
6 Aug 17, 2022
133 Jul 10, 2024
0 Jul 29, 2022
28 Dec 7, 2022
7 Jul 8, 2021
63 Dec 26, 2022
11 Jun 30, 2022
14 Jul 9, 2022
306 Jan 4, 2023
14 Jan 4, 2023
6 Jan 25, 2023
21 Sep 8, 2023