logo

drewdevault.com

[mirror] blog and personal website of Drew DeVault git clone https://hacktivis.me/git/mirror/drewdevault.com.git

Himitsu.md (7816B)

    

  1. ---
  2. title: Introducing the Himitsu keyring & password manager for Unix
  3. date: 2022-06-20
  4. ---
  6. [Himitsu] is a new approach to storing secret information on Unix systems, such
  7. as passwords or private keys, and I released version 0.1 this morning. It's
  8. available on [Alpine Linux] community and the [Arch User Repository], with [more
  9. distributions] hopefully on the way soon.
  11. [Himitsu]: https://himitsustore.org
  12. [Alpine Linux]: https://wiki.alpinelinux.org/wiki/Himitsu
  13. [Arch User Repository]: https://wiki.archlinux.org/title/Himitsu
  14. [more distributions]: https://repology.org/project/himitsu/versions
  16. So, what is Himitsu and what makes it special? The following video introduces
  17. the essential concepts and gives you an idea of what's possible:
  19. <iframe title="Introduction to the Himitsu secret key store" src="https://spacepub.space/videos/embed/5f9e5407-64a6-4776-9175-de744f2e7bc4" allowfullscreen="" sandbox="allow-same-origin allow-scripts allow-popups" width="560" height="315" frameborder="0"></iframe>
  21. If you prefer reading to watching, this blog post includes everything that's in
  22. the video.
  24. ## What is Himitsu?
  26. Himitsu draws inspiration from Plan 9's [factotum], but polished up and
  27. redesigned for Unix. At its core, Himitsu is a key/value store and a simple
  28. protocol for interacting with it. For example, a web login could be stored like
  29. so:
  31. [factotum]: http://man.9front.org/4/factotum
  33. ```
  34. proto=web host=example.org user=jdoe password!=hunter2
  35. ```
  37. Himitsu has no built-in knowledge of web logins, it just stores arbitrary keys
  38. and values. The bang (!) indicates that the password is a "secret" value, and
  39. the "proto" key defines additional conventions for each kind of secret. For
  40. proto=web, each key/value pair represents a form field on a HTML login form.
  42. We can query the key store using the "hiq" command. For instance, we can obtain
  43. the example key above by querying for any key with "proto=web", any "host",
  44. "user", and "password" value, and an optional "comment" value:
  46. ```
  47. $ hiq proto=web host user password! comment?
  48. proto=web host=example.org user=jdoe password!
  49. ```
  51. You'll notice that the password is hidden here. In order to obtain it, we must
  52. ask for the user's consent.
  54. ```
  55. $ hiq -d proto=web host user password! comment?
  56. ```
  58. ![A screenshot of a GTK+ dialog confirming the operation](https://l.sr.ht/aTfn.png)
  60. ```
  61. proto=web host=example.org user=jdoe password!=hunter2
  62. ```
  64. You can also use hiq to add or delete keys, or incorporate it into a shell
  65. pipeline:
  67. ```
  68. $ hiq -dFpassword host=example.org
  69. hunter2
  70. ```
  72. ## A simple, extensible protocol
  74. The protocol is a simple line-oriented text protocol, which is documented in the
  75. [himitsu-ipc(5)] manual page. We can also use it via netcat:
  77. [himitsu-ipc(5)]: https://himitsustore.org/docs/himitsu-ipc.5.html
  79. ```
  80. $ nc -U $XDG_RUNTIME_DIR/himitsu
  81. query host=example.org
  82. key proto=web host=example.org user=jdoe password!
  83. end
  84. query -d host=example.org
  85. key proto=web host=example.org user=jdoe password!=hunter2
  86. end
  87. ```
  89. The consent prompter also uses a standardized protocol, documented by
  90. [himitsu-prompter(5)]. Based on this, you can implement new prompters for Qt, or
  91. the TTY, or any other technology appropriate to your system, or implement a more
  92. novel approach, such as sending a push notification to your phone to facilitate
  93. consent.
  95. [himitsu-prompter(5)]: https://himitsustore.org/docs/himitsu-prompter.5.html
  97. ## Additional frontends
  99. Based on these protocols, a number of additional integrations are possible.
  100. Martijn Braam has written a nice GTK+ frontend called [keyring]:
  102. [keyring]: https://git.sr.ht/~martijnbraam/keyring/
  103. ![A screenshot of the GTK+ frontend](https://brixitcdn.net/metainfo/keyring.png)
  105. There's also a [Firefox add-on] which auto-fills forms for keys with proto=web:
  107. [Firefox add-on]: https://addons.mozilla.org/en-US/firefox/addon/himitsu-integration/
  108. ![Screenshot of himitsu-firefox](https://l.sr.ht/eLcs.png)
  110. We also have a package called [himitsu-ssh] which provides an SSH agent:
  112. [himitsu-ssh]: https://git.sr.ht/~sircmpwn/himitsu-ssh
  114. ```
  115. $ hissh-import < ~/.ssh/id_ed25519
  116. Enter SSH key passphrase: 
  117. key proto=ssh type=ssh-ed25519 pkey=pF7SljE25sVLdWvInO4gfqpJbbjxI6j+tIUcNWzVTHU= skey! comment=sircmpwn@homura
  118. $ ssh-add -l
  119. 256 SHA256:kPr5ZKTNE54TRHGSaanhcQYiJ56zSgcpKeLZw4/myEI sircmpwn@homura (ED25519)
  120. $ ssh git@git.sr.ht
  121. Hi sircmpwn! You've successfully authenticated, but I do not provide an interactive shell. Bye!
  122. Connection to git.sr.ht closed.
  123. ```
  125. I hope to see an ecosystem of tools built around Himitsu to grow. New frontends
  126. like keyring would be great, and new integrations like GPG agents would also be
  127. nice to see.
  129. ## Zero configuration
  131. Himitsu-aware software can discover your credentials and connection details
  132. without any additional configuration. For example, a mail client might look for
  133. `proto=imap` and `proto=smtp` and discover something like this:
  135. ```
  136. proto=imap host=imap.migadu.com user=sir@cmpwn.com password! port=993 enc=tls
  137. proto=smtp host=imap.migadu.com user=sir@cmpwn.com password! port=465 enc=tls
  138. ```
  140. After a quick consent prompt, the software can load your IMAP and SMTP
  141. configuration and get connected without any manual steps. With an agent like
  142. himitsu-ssh, it could even connect without actually handling your credentials
  143. directly &mdash; a use-case we want to support with improvements to the prompter
  144. UI (to distinguish between a case where an application will *view* versus *use*
  145. your credentials).
  147. ## The cryptography
  149. Your key store is located at $XDG\_DATA\_HOME/himitsu/. The key is derived by
  150. mixing your password with argon2, and the resulting key is used for AEAD with
  151. XChaCha20+Poly1305. The "index" file contains a list of base64-encoded encrypted
  152. blobs, one per line, enumerating the keys in the key store.[^1] Secret keys are
  153. encrypted and stored separately in files in this directory. If you like the pass
  154. approach to storing your keys in git, you can easily commit this directory to a
  155. git repository, or haul it along to each of your devices with whatever other
  156. means is convenient to you.
  158. [^1]: This offers an improvement over pass, for example, by not storing the list of entries in plain text.
  160. Himitsu is written in Hare and uses cryptography primitives available from its
  161. standard library. Note that these have not been audited.
  163. ## Future plans
  165. I'd like to expand on Himitsu in the future. One idea is to store your full disk
  166. encryption password in Himitsu and stick a subset of your key store into the
  167. initramfs, which you unlock during early boot, pull FDE keys out of, and then
  168. pre-authorize the keyring for your desktop session - which you're logged in to
  169. automatically on the basis that you were pre-authorized during boot.
  171. We also want to add key sharing and synchronization tools. The protocol could
  172. easily be moved to TCP and authorized with your existing key store key (we could
  173. make an ed25519 key out of it, or generate and store one separately), so setting
  174. up key synchronization might be as simple as:
  176. ```
  177. $ hiq -a proto=sync host=himitsu.sr.ht
  178. ```
  180. You could also use Himitsu for service discovery &mdash; imagine a key ring
  181. running on your datacenter LAN with entries for your Postgres database, SMTP
  182. credentials, and so on.
  184. There are some other ideas that we could use your help with:
  186. - himitsu-firefox improvements (web devs welcome!)
  187. - Chromium support (web devs welcome!)
  188. - Himitsu apps for phones (mobile devs welcome!)
  189. - More key management frontends (maybe a TUI?)
  190. - More security options &mdash; smart cards? U2F?
  191. - hare-ssh improvements (e.g. RSA keys)
  192. - PGP support
  193. - Anything else you can think of
  195. Please join us! We hang out on IRC in #himitsu on Libera Chat. Give Himitsu a
  196. shot and let us know what you think.
  198. Alright, back to kernel hacking. I got multi-tasking working yesterday!