A Django-based password manager REST service with client-side encryption
opqpwd is a password manager REST service with client-side encryption.
opqpwd stands for “opaque passwords”: it encrypts password on the client-side, making them “opaque” to the server. Moreover, user registration and authentication is performed using salted hashes of user-chosen username and password: this boosts users anonimity with respect to traditional services, hiding even the service-registration username.
Passwords (and metadata) are stored in your favorite database as Base64-encoded, encrypted JSON. Encryption is performed using AES-256-CBC, with HMAC-SHA-256 authentication.
scrypt is used as key derivation function.
It features an example command-line client (you can find it in the bin folder).
opqpwd was written by Marco Bellaccini - marco.bellaccini(at!)gmail.com.
BEWARE: OPQPWD IS PROOF-OF-CONCEPT SOFTWARE, FOR TESTING PURPOSES ONLY.
Make sure you meet all software dependencies (Django REST Framework, scrypt - you’ll need libssl-dev for it, pycrypto, requests and, of course, Django).
Add “opqpwd” and “rest_framework” (of course, you have to install Django REST Framework too!) to your INSTALLED_APPS setting like this:
INSTALLED_APPS = [ ... 'rest_framework', 'opqpwd', ]
In the same file (settings.py), specify this custom authentication backend:
# set custom authentication backend AUTHENTICATION_BACKENDS = ['opqpwd.authentication.UserCredBackend']
Include the opqpwd URLconf in your project urls.py like this:
Note: make sure you import include with from django.conf.urls import include.
Run python manage.py migrate to create the opqpwd models.
Start the development server (BEWARE: in a real environment you should run it over https, however, as already stated, THIS IS A PROOF-OF-CONCEPT SOFTWARE, FOR TESTING PURPOSES ONLY).
Start the cli-client script:
Note: if you installed the package as a user library, the script will likely be in .local/bin in your home folder.
Connect to the development server:
Register a user:
(if you want, you can also generate an authentication token to use along with the password)
Add a password to the db:
List all stored passwords titles:
Print details of the password you just stored:
Upload encrypted passwords to the server:
Get help with the other commands:
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.