django-cenvars 0.0.1.1

Overview

For encryption we use both RSA and AES, for AES a 256 bit key is used which is encrypted with an 2048 bit RSA key. The RSA is an asymmetric key, the decryption key (Private key) is used by the client, whilst the encryption key (Public key) is used by the server.

Prior to sending the ‘data’ to the client, the server creates a new 256 bit AES key. This key is used to encrypt the text block and than is encrypter with the RSA encryption key. The resulting blob is prepended to the

> json dict > zip > AES encrypt >

> https://example.com/cenvars/?identifier=hexdigest < BLOB

(this is the hexdigest of the N value of an RSA key).

Caveat

Introducing single points of failure in your architecture should not be undertaken lightly, unless having a centralised variables services makes sense in your setup, I would recommend against using this service.

The cryptography used in the library (RSA and AES) are there to provide a barrier for accidental leaking of the raw file data, however the access keys are in the end stored on the machines themselves, thus having login access to the client machine will show all the environment variables of that machine. Having login access to the server will reveal all environmental variables.

Proceed with caution, be forewarned and vigilant, you are putting all eggs into one basket here, however unless you have another way to cryptographically store and injecting environmental variables, this will be a big improvement, both for security and management.