EncryptAGit - Encrypt Your Git Repos

Overview

Downloads

EncryptAGit

Encrypt Your Git Repos

Authors

Installation

pip install encryptAgit

Upgrade

pip install encryptAgit --upgrade

Requirements

  • GitPython
  • pathlib
  • cryptography
  • pathspec

Why??

OK. I'm already paying for github. It stores files. And has versioning.

I wanted to see how hard it would be to write something from scratch with reasonable security...

..That I wouldn't mind using.

I'm using encryptAgit as a note taking app. I can use whatever editor I want. Sublime Text, vim, emacs, VS Code. Whatever that writes files to disk.

You could use encryptAgit to keep your notes/code private, but yet public, and share the key with only people you want to have access.

Feel free to share how you are using it!

Threat model

My threat model does not include Mossad.

If someone is on your computer capturing keystrokes, this won't help you.

If someone comes across your gitrepo of encrypted notes and they want to decrypt it, it's not going to be easy (depends on your password/salt combos - read more...).

Security

I'm using fernet.

As this is a store of secrets, I can't use a random salt. The user provides it.

To produce the encryption/decryption key, I'm using Scrypt with the user provided salt to make the Key Derivation Function and then the user password is provided to derive the key.

It takes over 1 sec to compute the key on a late model macBook pro (not an M1).


random.seed(user_salt)
# The salt must be consistent and it is secret.
# Not md5!
self.salt = random.randbytes(16)

kdf = Scrypt(
    salt=self.salt,
    length=32,
    n=2**15,
    r=13,
    p=3,
)

start = time.time()
self.key = base64.urlsafe_b64encode(kdf.derive(bytes(password, 'iso-8859-1')))
end = time.time()

I consider the salt and password to be secrets. Maybe share one of each between friends so only the two of you can open a git repo. I don't know. Either way, keep them secure.

Encrypted files (tokens - fernet speak) are stored in encrypted_git.json.

encrypted_git.json format:

{
    {
  "full_file_path": {
    "token": "gAAAAAABidd63NQSVrcIRrq9f_g68o4KV13w3SiSXSPI5fxOJNnhlyUUU0eTnzlzkBf_mdRsvZeeh8Sq8YO7yV2GaqB56qNai7t_kkbgJ34OiDLl_N-bXviELx5MSyblp-EbKciUsYH67qIpbnTsbw9KZcQg5uzp9RIlWT9aYaEOruJbEjLSM7_KoWWLKtajFaZ87t9ZY_3nJ7AdSdvOx645Th9VXWxrxV3PQtXaLUYCUYIpfKV3w_9uHCRoA=",
    "filehash": "ee7d78b32d112e88d69fa0739e3217c0d44b193ccbb7579909e1b72e7839f7b5922b5ca80d5f88b3e60aa67dd1ee379b8f74f9dc824b2c6c509471a11d406789"
  },

}

filehash is the sha512 of the user provided salt + the file contents.


    def hash_file(self, file_path):
        return hashlib.sha512(self.salt + open(file_path, 'rb').read()).hexdigest()

This helps to prevent searching for a file by hash.

No keying material is logged or written to disk.

Yes, you can see the repo_path + file name in the encrypted_git.json file. Make sure it is not sensitive info. Reason this is not encrypted is it allows for speed and minimizes decryption cycles to check if a file has been modified. One might say, you could encrypt the full_file_path, like so...

{
    1: {"fullPath": "CBAAAAABidd63NQSVrcIRrdsas63635181faske82",
    "token": "gAAAAAABidd63NQSVrcIRrq9f_g68o4KV13w3SiSXSPI5fxOJNnhlyUUU0eTnzlzkBf_mdRsvZeeh8Sq8YO7yV2GaqB56qNai7t_kkbgJ34OiDLl_N-bXviELx5MSyblp-EbKciUsYH67qIpbnTsbw9KZcQg5uzp9RIlWT9aYaEOruJbEjLSM7_KoWWLKtajFaZ87t9ZY_3nJ7AdSdvOx645Th9VXWxrxV3PQtXaLUYCUYIpfKV3w_9uHCRoA=",
    "filehash": "ee7d78b32d112e88d69fa0739e3217c0d44b193ccbb7579909e1b72e7839f7b5922b5ca80d5f88b3e60aa67dd1ee379b8f74f9dc824b2c6c509471a11d406789"
    },

}

Whereas, the fullPath is kept decrypted in a python dict pointing to the current filehash. However, the fullPath will allways be different when encrypted and great care will be required to ensure I'm not writing to the encrypted_git.json file multiple times for the same file. To properly find the file to change/update/remove, I'd have to decrypt each fullPath to ensure I had an exact match - then update or drop the file from the json blob.

Hmm... I'll pass for now.

Keep your filenames non-sensitive!

And use a passphrase for your salt and passwords.

Isn't this like chef data-bags?

Not really. Fernet is AES-CBC. It's authenticated. The difference is I'm using Scrypt to derive a password vs pkcs5_keyivgen, which is depreciated and is not using a salt. I'm requiring it.

Usage

This works best in a fresh git repo. I haven't implemented git history squashing yet. So any old files will be in your git history.

Maybe I'll implement git history squashing/deletion in a new release.

  1. git clone your notes repo
  2. Change directory to it.
  3. Execute encryptAgit.py
encryptAGit
๐Ÿ˜„ No encrypted_git.json file, seems like first use!
๐Ÿค— Welcome to encryptAGit! Let's encrypt your repo!
๐Ÿค“ Use a passphrase for both salt and password. Remember what you enter!
๐Ÿง‚Enter your salt:
๐Ÿ•ต๏ธ Enter your password:
[*] It took 1.185420036315918 seconds to make the key.
[*] Updating moo.txt in encrypted store
[*] Updating hello.txt in encrypted store
[*] Updating pictures/kailua_beach.png in encrypted store
[*] Updating pictures/washington_monument.png in encrypted store
[*] Updating notes/unencryped.txt in encrypted store
[*] Updating notes/testing.txt in encrypted store
[*] Updating notes/1/more.txt in encrypted store
[*] Writing updated encrypted_git.json
[*] Push of encrypted_git.json complete!

Now any SAVED changes to files in your git repo will be automatically encrypted and pushed to your git repo.

Here I saved a file in a new directory called newdir called newfile.txt:

[*] Updating newdir/newfile.txt in encrypted store
[*] Writing updated encrypted_git.json
[*] Push of encrypted_git.json complete!

Use .gitignore:

 cat .gitignore 
*.swp
.DS_Store
README.md

Any files you put in .gitignore will not be encrypted, deleted, or saved. You have to git add, commit, and push those yourself.

Ending the process and changing password

Hit CTRL+C and you will be asked if you want to rotate your salt/password.

Type n if you don't, y if you do.

encryptAgit
๐Ÿ˜Š Welcome Back to encryptAGit! Let's decrypt your repo!
๐Ÿง‚Enter your salt:
๐Ÿ•ต๏ธ Enter your password:
[*] It took 1.0983080863952637 seconds to make the key.
[*] Writing decrypted moo.txt to disk.
[*] Writing decrypted hello.txt to disk.
[*] Writing decrypted pictures/kailua_beach.png to disk.
[*] Writing decrypted pictures/washington_monument.png to disk.
[*] Writing decrypted newdir/newfile.txt to disk.
[*] Writing decrypted notes/unencryped.txt to disk.
[*] Writing decrypted notes/testing.txt to disk.
[*] Writing decrypted notes/1/more.txt to disk.
^C
๐Ÿ’ญ Do you want to change your salt and password? (y/n):

If you want to backout completely without erasing your UNENCRYPTED files type CTRL+C twice in a row.

sys.exit(main()) File "/Users/pioneer/homebrew/lib/python3.9/site-packages/encryptAgit.py", line 361, in main run.run() File "/Users/pioneer/homebrew/lib/python3.9/site-packages/encryptAgit.py", line 346, in run answer = input('\n๐Ÿ’ญ Do you want to change your salt and password? (y/n):') KeyboardInterrupt ">
encryptAgit
๐Ÿ˜Š Welcome Back to encryptAGit! Let's decrypt your repo!
๐Ÿง‚Enter your salt:
๐Ÿ•ต๏ธ Enter your password:
[*] It took 1.0983080863952637 seconds to make the key.
[*] Writing decrypted moo.txt to disk.
[*] Writing decrypted hello.txt to disk.
[*] Writing decrypted pictures/kailua_beach.png to disk.
[*] Writing decrypted pictures/washington_monument.png to disk.
[*] Writing decrypted newdir/newfile.txt to disk.
[*] Writing decrypted notes/unencryped.txt to disk.
[*] Writing decrypted notes/testing.txt to disk.
[*] Writing decrypted notes/1/more.txt to disk.
^C
๐Ÿ’ญ Do you want to change your salt and password? (y/n):^CTraceback (most recent call last):
  File "/Users/pioneer/homebrew/lib/python3.9/site-packages/encryptAgit.py", line 339, in run
    time.sleep(1)
KeyboardInterrupt

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/pioneer/homebrew/bin/encryptAgit", line 8, in 
    sys.exit(main())
  File "/Users/pioneer/homebrew/lib/python3.9/site-packages/encryptAgit.py", line 361, in main
    run.run()
  File "/Users/pioneer/homebrew/lib/python3.9/site-packages/encryptAgit.py", line 346, in run
    answer = input('\n๐Ÿ’ญ Do you want to change your salt and password? (y/n):')
KeyboardInterrupt

Editing files offline

Let's say to do a double CTRL+C and want to edit files offline - feel free to do so! Then later start encryptAgit again, if there were no edits to the decrypted files you won't get a warning:

encryptAgit
๐Ÿ˜Š Welcome Back to encryptAGit! Let's decrypt your repo!
๐Ÿง‚Enter your salt:
๐Ÿ•ต๏ธ Enter your password:
[*] It took 1.073664903640747 seconds to make the key.
^C  
๐Ÿ’ญ Do you want to change your salt and password? (y/n):n

[*] Exiting
๐Ÿ‘‹ Removing unencrypted files not in .gitignore

If you edit the files without encryptAgit running you'll be asked to overwrite the newer file or not after running encryptAgit again:

โžœ  git-notes git:(main) โœ— vim moo.txt
โžœ  git-notes git:(main) โœ— encryptAgit              
๐Ÿ˜Š Welcome Back to encryptAGit! Let's decrypt your repo!
๐Ÿง‚Enter your salt:
๐Ÿ•ต๏ธ Enter your password:
[*] It took 1.0608000755310059 seconds to make the key.
[!] moo.txt has changed since last encryption
[!!] Seems the file on disk has changed from the encrypted file, overwrite it from the encrypted version? (y/n):n
[*] Updating moo.txt in encrypted store.
[*] Writing updated encrypted_git.json
[*] Push of encrypted_git.json complete!

Enjoy

Please submit any bug reports to the github repo...

Considerations

GitHub repo and file size limits.

TODO

  • Add git history squashing option on user password change.
  • Video on example usage
  • Inspection of encrypted files before overwrite of new file or not
Owner
midnite_runr
I laugh in the general direction of security products.
midnite_runr
Python binding to the Networking and Cryptography (NaCl) library

PyNaCl: Python binding to the libsodium library PyNaCl is a Python binding to libsodium, which is a fork of the Networking and Cryptography library. T

Python Cryptographic Authority 941 Jan 04, 2023
Skepticoin is a peer-to-peer digital currency that enables you to send money online

What is Skepticoin? Skepticoin is a peer-to-peer digital currency that enables you to send money online. It's also the central community of people who

64 Aug 06, 2022
Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server.

Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. It can also act as a client for any other CA that uses the ACME protocol.

29.5k Dec 31, 2022
Small utility to encrypt and decrypt messages

Safe Safe is a small utility to encrypt and decrypt messages using a pair of public and private keys. Installation You need to have GPG installed in y

Gustavo Eguez 2 Dec 21, 2021
Coins farmer for dank memer

Created by TheRider#5308 [feel free to drop by to talk]. Note to some Dank Memer staff reading this: Nah I don't self bot, already got banned for that

Siddhant Kumar 3 Nov 10, 2021
Python app for encrypting messages with fernet cryptography.

Fernet Encryption Python app for encrypting messages with fernet cryptography. Github repo: https://github.com/mystic-repo/FernetEncryption PyPi: http

Mystic 1 May 28, 2022
GmJEWEL - The monorepo for the Greedy Merchants Guild

Greedy Merchants Guild Hello! Welcome to the monorepo for the Greedy Merchants G

Greedy Merchants Guild 5 Mar 09, 2022
Encrypt Your Script Python

EncryptScritpPY Encrypt Your Script Python This Script For Encrypt Your File Python Tutorial Install [+] Open Termnal [+] Type: git clone https://gith

1 Oct 07, 2021
Cryptocurrency application that displays instant cryptocurrency prices and reads prices with the Google Text-to-Speech library.

๐Ÿ“ˆ Cryptocurrency Price App ๐Ÿ’ฐ โ—ฝ Cryptocurrency application that displays instant cryptocurrency prices and reads prices with the Google Text-to-Speec

Furkan Mert 2 Nov 08, 2021
Secure open-source password manager.

aes256_passwd_store This script securely encrypts or decrypts passwords on disk within a custom database file. It also features functionality to retri

14 Nov 15, 2022
An extreme encryption for everyone, encrypt your text before sending to anyone.

An extreme encryption for everyone, encrypt your text before sending to anyone. Alphabets and numbers are going to be encrypted like a hell

Saad 6 Oct 28, 2022
This project is a proof of concept to create a dashboard using Dash to display information about various cryptocurrencies.

This project is a WIP as a way to display useful information about cryptocurrencies. It's currently being actively developed as a proof of concept, and a way to visualize more useful data about vario

7 Apr 21, 2022
Tracking (of choice) cryptocurrencies' daily prices and moving average.

Crypto-price-moving_average Tracking (of choice) cryptocurrencies' daily prices and moving average. About Alpha Vantage The Alpha Vantage library (htt

Thong Huynh 2 Jan 22, 2022
Freqtrade is a free and open source crypto trading bot written in Python

Freqtrade is a free and open source crypto trading bot written in Python. It is designed to support all major exchanges and be controlled via Telegram. It contains backtesting, plotting and money man

20.2k Jan 07, 2023
A little side-project API for me to learn about Blockchain and Tokens

BlockChain API I built this little side project to learn more about Blockchain and Tokens. It might be maintained and implemented to other projects bu

Loรฏk Mallat 1 Nov 16, 2021
This is simple Blockchain ,miner and wallet to send crypto using python

pythonBlockchain-SImple This is simple Blockchain ,miner and wallet to send crypto using python It is simple Blocchain so it can only dobasic work usi

3 Nov 22, 2022
Technical_indicators_cryptos - Using technical indicators to find optimal trading strategies to deploy onto trading bot.

technical_indicators_cryptos Using technical indicators to find optimal trading strategies to deploy onto trading bot. In the Jup Notebook you wil

Van 4 Jul 03, 2022
Amazing CryptoWAF was a CTF challenge for ALLES! CTF 2021

ctf-cryptowaf The AmazingCryptoWAF โ„ข๏ธ is used by the "noter" web app, to offer automagically military encryption for any user data. Even if an attacke

32 Jan 02, 2023
A simple script useful to switch from Dashlane to Bitwarden by converting the password file to the right format.

A simple script useful to switch from Dashlane to Bitwarden by converting the password file to the right format.

3 May 06, 2022
Random Password Generator With Python

Random_Password_Generator example output length

Mahdi Rostami Pooya 2 Dec 22, 2021