Sagecipher

lastmod 2025-04-10created 2023-03-1812 edits

Uses SSH agent to encrypt/decrypt arbitrary data

About

This can be used in turn by the keyring library, and by ansible-vault to encrypt/decrypt files or secrets via the users' local or forwarded ssh-agent session.

Simple usage

source <(ssh-agent)
ssh-add

See ssh-agent, ssh-add, Python Keyring Lib.

Using sagecipher directly in Python

>>> from sagecipher import Cipher
>>>
>>> # Encrypts using the first SSH key available from SSH agent...
>>> enc_text = Cipher.encrypt_string("hello, world")
>>> text = Cipher.decrypt_string(enc_text)
>>> text
"hello, world"

Checking whether SSH Agent is running

If you can't check with an environment variable like SSH_AGENT_PID, sagecipher uses paramiko internally, so check with that.

def is_valid_sagecipher() -> bool:
    from paramiko import Agent

    return bool(Agent().get_keys())

Troubleshooting

SSH agent is not running or no keys are available

See Paramiko#SSH agent is not running or no keys are available.

See also

• keyring
• python
• Secure Coding#Key store
• ssh-agent
• ssh-add
• paramiko

Favorite site

• sagecipher · PyPI
• p-sherratt/sagecipher: Uses SSH agent to encrypt/decrypt arbitrary data