Wardkey

Wardkey is an experimental local credential broker designed specifically for Git and the AWS Command Line Interface (CLI) on Windows. The tool prioritizes security by storing credentials within an encrypted vault and implementing local policy enforcement, which can include a verification step through Windows Hello.

Key Features

• Encrypted Credential Storage: Safely stores and protects credentials using robust encryption mechanisms.
• Application-Aware Access Control: Evaluates not just the user but also the requesting application before releasing credentials, enhancing flexibility and security.
• Windows Hello Integration: Optionally requires user approval via Windows Hello, providing an additional layer of security during credential retrieval.
• Comprehensive Auditing: Maintains a detailed audit log of all credential release requests and any denied or invalid attempts, ensuring transparency and accountability.

How It Works

Wardkey operates as an intermediary between the credential requests from Git or AWS CLI and the operating system, following a structured process:

START
  ↓
Git credential helper / AWS credential_process
  ↓
Windows Named Pipe
  ↓
OS-derived peer PID
  ↓
Handler.Handle()
  ↓
Credential request validation
  ↓
Caller identity & process verification
... (continues)

The Concept

Unlike traditional credential helpers that simply grant access based on user identity, Wardkey incorporates application context as shown below:

Standard Approach:

User
  ↓
Credential helper
  ↓
Credential

With Wardkey:

Application
  ↓
Wardkey
  ↓
Process identity
  ↓
Policy
  ↓
Allow / Deny / Approval
  ↓
Credential

Technologies Used

• Programming Language: Built using Go.
• Windows Integration: Utilizes Windows named pipes, ACLs for access control, process identity inspection, and supports Windows WebAuthn.
• Cryptographic Security: The credential vault employs advanced encryption methods, including Argon2id and XChaCha20-Poly1305, while audit logs are secured using HMAC integrity mechanisms.

Commands

Wardkey offers a variety of commands to manage and operate the credential broker effectively:

• wardkey init: Initializes the encrypted vault with a user-defined passphrase.
• wardkey add: Adds a new credential to the vault securely.
• wardkey serve: Activates the credential broker to handle requests from Git and AWS CLI.
• wardkey lock: Locks the broker, preventing any credential release.
• Additional commands facilitate credential management, system diagnostics, and audit verification.

Limitations

• Platform Restriction: Currently, Wardkey is available only for Windows.
• Compatible Tools: Supports only the official AWS CLI; third-party tools are not yet integrated.
• User Experience: Frequent Windows Hello prompts may occur if used with approval-required policies.

Security Advisory

As an experimental project, Wardkey has known limitations. Users are advised to refer to the SECURITY.md and THREAT_MODEL.md files for a better understanding of the project's security posture and best practices.