🌰 ssh-vault

What is ssh-vault?

ssh-vault is a command-line tool designed for the seamless creation of encrypted files, known as "vaults" leveraging SSH keys, specifically RSA or Ed25519, for the encryption and decryption processes.

This tool operates by encrypting a vault password with the recipient's public SSH key. To access or decrypt the vault contents, the recipient must utilize their private key and password, ensuring a secure and controlled means to edit or view the contents when necessary.

For detailed guidance on generating an SSH key, refer to: Generating an SSH Key

Why?

Because of the need to share sensitive data without the need to share a password.

Challenges arise when collaborating with multiple teams for testing or deploying projects. Often, there's a common practice of sharing confidential information such as database passwords, HTTP authentication credentials, and tokens by simply sending these "secrets" through various chat platforms.

While PGP is a standard for such scenarios, it comes with the drawback of time-consuming public key exchange and requires a certain level of knowledge for effective secret sharing.

This is where ssh-vault proves invaluable. It adheres to the principles of PGP but streamlines the exchange process, facilitating the swift and secure sharing of "secrets." The key innovation lies in shifting the burden of key pre-sharing to the version control system already in use by the team, with GitHub being the default for ssh-vault.

In essence, ssh-vault simplifies the process by leveraging existing public key exchange mechanisms within the version control system. For instance, if both user A and user B use GitHub, sharing a secure "secret" becomes straightforward without the need for a pre-handshake, enhancing efficiency and security in the exchange of sensitive information.