json-keystore

EARLY PREVIEW RELEASE of a rudimentary python library for encrypted JSON

Future Plans

• Add AES encryption, or port samples to CryptoDomeX

Install and Initial Setup

This utility allows you to set up an encrypted JSON keystore that supports both GPG and Trezor-CipherKeyValue encryption. You will need either a GPG key pair installed, or a Trezor attached. As a fallback you can store data in naked JSON, but that is obviously not recommended.

Install with Debug support

If you want to debug one of the client calls or step into a trezorlib call, you can install from GIT sources. Then you can add breakpoints in source using calls to breakpoint() to get more detailed information.

1. Get source: git clone https://github.com/brianddk/json-keystore.git
2. Switch directories: cd json-keystore
3. Upgrade setuptools: python -m pip install --upgrade setuptools pip wheel
4. Install develop mode via pip: pip install -e .
5. Verify install: python -c "import json_keystore"
6. Optionally add breakpoint() into one of the *.py files
7. Optionally step through code in the python debugger (pdb)

Install without GIT

To install the most recent edition directly from GitHub tarball:

python -m pip install --upgrade setuptools pip wheel
python -m pip install git+https://github.com/brianddk/json-keystore.git

You won't get to documentation or templates, but all the code will land and function

Install last release from PIP

1. Upgrade: python -m pip install --upgrade setuptools pip wheel
2. Install: pip install json-keystore
3. Verify install: python -c "import json_keystore"

Building a Keystore

Template keystores are provided in the templates directory. If you decide to use a naked JSON, you can simply modify the null values in the json_ks.json to fill in the key values. If you want to use encryption you will need to modify on of the encryption templates (trezor_ks.json or gnupg_ks.json) and update the unencrypted parameters. These all deal with various encryption settings. Note that for Trezor, zlib is the ONLY supported compression. Since the JSON keystore is self explanatory, I'll focus on building the encrypted keystores.

Building a GnuPG encrypted Keystore:

Start with the GnuPG template gnupg_ks.json, and change the recipient to the key-id of your GnuPG key. This can be the UID (email), or the short or long key hex.

{
  "format": "gnupg",
  "gnupg": {
    "recipient": "TYPE_YOUR_GPG_PUBLIC_KEY_HERE"
  }
}