session

Overview ¶

Package session provides secure passphrase caching via OS keyring.

Security Model:

This package uses zalando/go-keyring to store vault passphrases in the OS keyring (macOS Keychain, Linux GNOME Keyring via D-Bus Secret Service, or Windows Credential Manager). The security properties are:

1. Encryption at Rest: All secrets are encrypted at rest by the OS keyring using AES-256 (macOS Keychain) or equivalent mechanisms.

2. Transport Security:

• macOS: Secret passed via stdin to /usr/bin/security CLI (not visible in ps)

• Linux: D-Bus Secret Service API transmits secret as bytes. D-Bus is local IPC; same-user processes can typically access session bus.

• Windows: Credential Manager API

  3. Access Control: OS keyring requires user authentication to unlock. The keyring typically prompts for password on first access per session.

Threat Model Considerations:

• Local user access: OS keyring provides appropriate protection against other local users (file permissions, user-specific keyring).
• Memory exposure: Passphrase exists in process memory during keyring operations - unavoidable with any keyring integration.
• D-Bus interception (Linux): D-Bus is not encrypted by default for local IPC. However, accessing D-Bus secrets requires the same user or specific system configuration. If an attacker can sniff D-Bus messages, they typically already have equivalent access to the user's session.

This implementation does NOT add additional encryption before keyring storage because: - The keyring already provides strong encryption at rest - Additional encryption would be security theater, not meaningful defense - The passphrase must be plaintext for the keyring API anyway

See: https://github.com/zalando/go-keyring for library details.