Skip to content

Latest commit

 

History

History
59 lines (41 loc) · 6.53 KB

README.md

File metadata and controls

59 lines (41 loc) · 6.53 KB
Raw

vault-secrets-abe

Unofficial ABE (Attribute Based Encryption) secrets plugin for Hashicorp Vault

Plugin Dependencies [Tested with] OS Dependencies
Hashicorp Vault v. 1.8.0 PBC Library
Docker v. 20.10 flex bison libssl-dev python-dev libgmp-dev build-essential
Golang v. 1.18.3

Vault Secrets ABE plugin

The following instructions will guide you on how to build the ABE binary and start a Hashicorp Vault server in dev mode. For more information and instructions on how to:

  • register users
  • use the policies
  • create requests to the Vault Secrets ABE plugin

kindly read the SETUP.md file. In the SETUP.md file you will find instructions on how to deploy a docker container, as well as a Postman Collection in order to easier reach and test out the plugin.

Instructions

  1. Execute:

    $ go mod tidy

  2. Build the ABE Plugin secret engine binary by executing:

    $ go build -ldflags "-X abe/plugin.sa_enabled=true" -o vault/plugins/abe

    sa_enabled
    true to enable SA capabilities, false to disable

  3. Run Hashicorp Vault in dev mode to register and test the Vault Secrets ABE plugin:

    $ vault server -dev -dev-root-token-id=root -dev-plugin-dir=./vault/plugins

  4. Export the VAULT_TOKEN & VAULT_ADDR environment variables:

    $ export VAULT_TOKEN=root && VAULT_ADDR="http://127.0.0.1:8200"

  5. Enable the plugin at the specified path:

    $ vault secrets enable -path=abe abe

You may now load the available policies that can be found at:

vault-secrets-abe/other/docker/policies

create some clients and use the ABE plugin.

Vault Secrets ABE plugin HTTP endpoints

PATH METHOD DESCRIPTION REQUEST BODY RESPONSE BODY
/encrypt POST Encrypt a message { "message": "Message to encrypt", "policy": "attr1 or attr2 and attr3 and SA" } { ... "data": { "b64_enc_data": "base64 encoded response", }, ... }
/ADMIN_ENTITY/addattributes POST Create ABE attributes and their corresponding keys { "authorityAttributes": ["auth_abe_attr1"], "commonAttributes": ["cmmn_abe_attr1"] } { ... "data": { "generated_data": { "public_segments": { "authority_attributes": [ { "Attribute": "AUTH_ABE_ATTR1", "alphai": "[..., ...]", "yi": "[..., ...]", }, ], "common_attributes": [ { "Attribute": "CMMN_ABE_ATTR1", "alphai": "[..., ...]", "yi": "[..., ...]", }, ], }, }, }, ... }
/keygen/ADMIN_ENTITY/CLIENT_ENTITY POST Generate keys for a Client Entity (by an Admin Entity) { "authorityAttributes": ["auth_abe_attr1"], "commonAttributes": ["cmmn_abe_attr1"] } { ... "data": { "Authority Keys generated:": ["AUTH_ABE_ATTR1"], "Common Keys generated:": ["CMMN_ABE_ATTR2"], "Generated for (GID)": "CLIENT_ENTITY", }, ... }
/syskeygen/SYSTEM_ATTRIBUTE/ADMIN_ENTITY POST Let an ADMIN ENTITY to have access to a system attribute (e.g. SYSTEM_ATTRIBUTE = SA) - { --- "data": { "Authority:": "ADMIN_ENTITY", "System Attribute": "SA" }, --- }
/sysdecrypt/ADMIN_ENTITY/CLIENT_ENTITY POST System Decrypt an ABE encrypted message and bind the system decrypted ciphertext with the CLIENT_ENTITY { "cryptogram":"", "sub_policy": "SA" } { --- "data": { "b64_enc_data_sysdec": "base64 encoded response", }, --- }
/decrypt/CLIENT_ENTITY POST Decrypt an ABE encrypted (or system decrypted) message { "cryptogram": "encrypted or system decrypted response", "sub_policy": "attr1 or attr2 and attr3" } { --- "data": { "decrypted_data": "Decrypted message (plaintext)" }, --- }