DEV Community

William Rodriguez
William Rodriguez

Posted on

Secrets locked to silicon: Machine-locked cryptography with wauth

#devops

If an attacker steals your database backup or leaks repository files, can they read your API keys? With wauth, encryption keys are derived from host hardware, making stolen vaults completely useless on foreign machines.

This is Day 01 of the WAuth Open-Source Engineering Series.

Production Implementation: Machine-Locked Key Derivation 

from wauth import WAuth

# Initializes with machine-derived Fernet key (hardware-bound)
auth = WAuth()

# Store secret encrypted with host-locked key
auth.set("STRIPE_SECRET_KEY", "sk_live_51MzQ98...")

# Auto-decrypted on THIS machine only
token = auth.get("STRIPE_SECRET_KEY")
print("Secret retrieved securely on authorized host.")
Enter fullscreen mode Exit fullscreen mode

Why This Changes Developer Velocity

  • Hardware-Bound Key Derivation: Derives 32-byte Fernet keys from salted machine UUID and host ID.
  • Zero Cross-Machine Portability: Encrypted vaults stolen from Machine A cannot be decrypted on Machine B.
  • Zero Plaintext on Disk: All secrets stored in local SQLite databases are encrypted at rest with zero plaintext leakage.

Eliminating Attack Vectors

  • Secrets stolen from database backups or leaked repository commits being reused on foreign machines.
  • Storing symmetric encryption master keys in plaintext environment variables next to application code.
  • Lack of cryptographically bound local secrets vaults for edge nodes and on-premise servers.

Explore the Open-Source Code

Author: William Steve Rodríguez Villamizar (Wisrovi)

Top comments (0)