hush
Peer-to-peer encrypted secret sharing from the terminal, with no servers in between.
- status
- Works, done learning
- latest release
- v1.1.1, macOS and Linux binaries
- language
- Go
- crypto
- SPAKE2 (schollz/pake) and AES-GCM
Share a password, an API key or a file directly between two machines with a short code, end-to-end encrypted. The code is both how the two machines find each other and the PAKE password.
I built it to learn Go and networking and kind of stopped adding features once I understood PAKE and TCP framing (it works tho). Discovery is a UDP broadcast, and after that it's TCP with length-prefixed frames. There's no relay and no STUN, so both machines have to be on the same network. When UDP doesn't get through, the -ip flag skips discovery and connects straight to the other machine.
Received files are saved as hush_<timestamp>.<ext> no matter what the sender called them, so a crafted file name can't write outside the folder, and there's a 10 MB cap.
trueseal started as the sync layer inside hush and turned into its own thing.