Add utility for loading a secret key from a defined format
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 1.2k
- Forks
- 267
- Avg merge
- 42m
- Merged PRs (30d)
- 2
Description
The secret key for use with e.g. secretbox should be 32 random bytes. A common mistake is to use only bytes that can be easily typed on a keyboard, like "secret password change me [padded to 32 bytes]" or E%m"lBVK=9&m6GRkm9n'c17C6Csd9?0C.
Part of the reason people do this is that E%m"lBVK=9&m6GRkm9n'c17C6Csd?0C is easier to store in e.g. a YAML file or environment variable than b'\xbf\x9e\x0e\xe6J\xe0T,\xc6\xa5\x81i\xc9\xf2\xb1#?\xf1\xa8\x96Q\xc9\x84\xe9\x8f\xe5\xec\x921\x06\xb2\xef'.
It might be good to define a standardized format in nacl.utils for loading printable, config-safe keys, into 32 bytes of random. One would be to load 64 hex bytes, like a20fbda2e9143075aa2a919c941eaad86652b17eacc4bc816fe399ce2b78c11d, into 32 random bytes.
Then you would put SECRET_KEY=a20fbda2e9143... in the environment and write:
key = nacl.utils.load('a20fbda2e9143075aa2a919c941eaad86652b17eacc4bc816fe399ce2b78c11d')
# or
key = nacl.utils.load(os.environ['SECRET_KEY'])
or load_32 etc. I maintain a Go nacl client and this is the strategy I use for letting users load keys. https://godoc.org/github.com/kevinburke/nacl#Load
Alternatively, you could have load_from_password('hunter2'), which could derive 32 bytes of random from a string using a suitable key derivation function like scrypt.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the existing nacl.utils API and the referenced Go nacl Load implementation. Resolve whether the utility should standardize hexadecimal loading, password-based derivation, or both; done means the format and behavior are agreed and the selected utility is implemented and documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100