Enigma Keyring.

What lives where

Enigma encrypts and decrypts each secret value. Keyring stores the encrypted value, label, and creation/update timestamps in a local SQLite database.

Labels and timestamps are stored unencrypted. The decrypted secret passes through host memory, and get prints it to standard output.

Build from source

The Keyring repository is coming soon. With a checkout, place the host library and Keyring side by side:

enigma/
├── enigma-host/
└── enigma-keyring/

cd enigma-keyring
cargo build --release
./target/release/enigma-keyring --help

Configure the vault

Create config.toml in your working directory:

vault_key_label = "keyring-vault"
database_location = "keyring.db"

The database and its table are created automatically. Keyring creates an AES vault key on Enigma when needed. Use a distinct vault-key label to avoid ambiguous key matches.

Relative paths are resolved from the working directory. Use --config /path/to/config.toml to select another configuration file.

Store and retrieve secrets

The following assumes Keyring is on your PATH. Keep Enigma connected for all commands.

# Prompts for the secret value and PIN when needed.
enigma-keyring create github/personal

# Lists labels and timestamps.
enigma-keyring list

# Decrypts and prints the secret value.
enigma-keyring get github/personal

# Deletes the local stored record.
enigma-keyring delete github/personal

Keep both parts

Retrieving a secret requires the local database and the original vault key on Enigma. Backing up the database preserves the encrypted records, but it does not back up the device key.

A new key with the same label cannot decrypt existing records. Keep that distinction in mind before deleting keys or reinitializing development hardware.

Secret sizes are bounded by the device’s USB payload limit. Keyring stores individual secret values; Seal is the file-encryption tool.