Hacker News Reader

I built Rot to solve this. It creates a git diff-able list of keyrings and secrets that you can inject via environment variables to sub commands, like `rot run mykeyring terraform apply`. You can use Shamir Secret Sharing to create "disaster recovery" access into the keyrings too.

https://rotx.dev

View on HN

I have a question, why would you call it rot? To me that sound something similar to Caesar cipher, also called rot13, which is far from being safe.

Rot's primary goal is crypto agility: you should be able to easily change secret values as well as the ciphers used to encrypt your stuff. Rot provides a robust rekey mechanism to ensure you're using the best encryption available.

So the naming of rot is because cryptographic keys have a tendency to "rot" rather quickly. Frequent use of keys inevitably leads to leakage and/or compromise, and the underlying encryption algorithms may not be secure in the future. Cryptographic material doesn't age well in general.

Reply on news.ycombinator.com