Andy Dixon
d95f2d04a4
Strip Fury back to its vault functionality in one `vault` command: genkey, init, add (file or directory, optional folder inside the vault), list, get, mv and rm. The hybrid FrodoKEM-640 + ML-KEM-768 encryption core is kept under internal/pqcrypt. Signing, policies, profiles, backups, SSH remotes, FIDO2, agents, provenance and compression are removed.
52 lines
1.7 KiB
Markdown
52 lines
1.7 KiB
Markdown
# vault
|
|
|
|
A post-quantum encrypted file vault in a single binary.
|
|
|
|
Files are encrypted with a hybrid FrodoKEM-640 + ML-KEM-768 key encapsulation
|
|
and ChaCha20-Poly1305. The vault directory holds only randomly named
|
|
ciphertexts. Names, sizes, modes and timestamps live inside encrypted
|
|
catalogue records of one fixed size. File bodies are padded to power-of-two
|
|
buckets.
|
|
|
|
## Build
|
|
|
|
```sh
|
|
go build . # produces ./vault
|
|
go test ./...
|
|
```
|
|
|
|
## Use
|
|
|
|
```sh
|
|
vault genkey # create ~/.vault/key, protected by a passphrase
|
|
vault init # create ~/.vault/store
|
|
vault add report.pdf # stored as report.pdf
|
|
vault add report.pdf work/2026 # stored as work/2026/report.pdf
|
|
vault add ./photos # every regular file under photos/
|
|
vault list # everything
|
|
vault list work # everything under work/
|
|
vault get work/2026/report.pdf # writes ./report.pdf
|
|
vault get report.pdf -o copy.pdf
|
|
vault mv report.pdf old/report.pdf
|
|
vault rm old/report.pdf
|
|
```
|
|
|
|
Adding a name that already exists replaces it. `get` refuses to overwrite an
|
|
existing file and writes nothing until the whole object has authenticated.
|
|
|
|
`--key PATH` and `--vault DIR` work with every command. They default to
|
|
`$VAULT_KEY` and `$VAULT_DIR`, then to `~/.vault/key` and `~/.vault/store`.
|
|
The passphrase is read from the terminal, or from `$VAULT_PASSPHRASE` for
|
|
scripts.
|
|
|
|
## Limits
|
|
|
|
- One writer at a time. Concurrent writes to the same vault are not locked.
|
|
- The storage host can see how many files exist, their size buckets and when
|
|
the vault changes.
|
|
- The key file is the only way in. Losing it or its passphrase loses the data.
|
|
|
|
## Licence
|
|
|
|
GPL-3.0-or-later. The cryptographic core is derived from Fury.
|