sealedbox

Overview ¶

Command sealedbox encrypts a value for the GitHub secrets API.

GitHub accepts an organization secret only as a libsodium sealed box (crypto_box_seal) of the value under the organization's public key. This helper reads the plaintext on stdin and the base64 public key from its first argument, and prints the base64 sealed box. It exists so the end-to-end setup can create a disposable secret on a machine with neither libsodium nor a NaCl binding, and it uses only the standard library so it adds nothing to the provider's module graph.

The construction is the one libsodium and golang.org/x/crypto/nacl/box (SealAnonymous) implement:

ephemeral keypair (epk, esk)
nonce  = BLAKE2b-192(epk || recipient)
key    = HSalsa20(X25519(esk, recipient), 0^16)
output = epk || XSalsa20-Poly1305(key, nonce, message)

It is test tooling for a disposable value: the primitives below are not constant-time and must not be used to protect real secrets.