Optionally encrypt cargo credentials under a passphrase

[tarcieri]

It would be nice if you could encrypt the cargo registry token under a key derived from a passphrase, much like ssh supports for private keys.

It's fairly common for developers to be running a large number of incorrectly firewalled services under their own user and have them listening on all network interfaces, and unless there's some sort of additional protection beyond filesystem perms, if any of these services are vulnerable to a directory traversal attack (such as the one all Rails apps were vulnerable to recently) files like ~/.cargo/config (or ~/.ssh/id_rsa) are easy to steal if someone is on public WiFi or are otherwise directly connectable. Firewalls help, but sometimes people spin up VMs and bridge them to their external interfaces without thinking about the security ramifications (and stick their credentials inside so they can develop inside a VM)

The rust-openssl or sodiumoxide libraries would provide what you need to do this. sodiumoxide in particular provides both scrypt (which can be used as a KDF) and modern authenticated symmetric ciphers like secretbox (xsalsa20+poly1305) and also a chacha20+poly1305 AEAD mode, while also being widely ported (Windows, *IX, Mac, iOS, Android at least to my knowledge)

I imagine this working by prompting a user for a passphrase after cargo login, or allowing them to just hit enter for no passphrase.

[tomjakubowski]

I would prefer to just re-use GPG for this, as Leiningen does. No need to reinvent the wheel and you get the benefit of gpg-agent if you want it.

[tarcieri]

gpg would also let you encrypt to a private key stored on a CCID card.

gpg1 is a bit odd about symmetric encryption though... it defaults to CAST5 o_O

This could also be done with PKCS#8 using a password derived via PBKDF2 using rust-openssl

[Eh2406]

Does this belong hear or does it belong on cargo?

[carols10cents]

Yeah, I think this should be in cargo's issues. Mind moving it over there @tarcieri ?

[tarcieri]

Done: rust-lang/cargo#3749