Save a vault to an encrypted file, and open it again

vault_save() writes the vault to a file encrypted with a passphrase, so tokens can be restored in a later session - in R or in Python, which read the same file. vault_open() reads it back; tokenising with the opened vault continues its numbering.

Usage

vault_save(vault, path, passphrase = NULL)

vault_open(path, passphrase = NULL, key = NULL)

Arguments

vault: A vault from cg_vault() or vault_open().
path: File to write or read, conventionally ending in .cgvault.
passphrase: The passphrase, or NULL to use CREDGATE_VAULT_PASSPHRASE or a prompt.
key: For a keyed vault: its token key, or NULL to use CREDGATE_TOKEN_KEY. The key is never saved; opening fails if it differs from the one the vault was saved with.

Value

vault_save() returns path invisibly; vault_open() returns a vault.

Details

The passphrase comes from passphrase, else the environment variable CREDGATE_VAULT_PASSPHRASE, else a prompt (in an interactive session with the askpass package). It needs at least 12 characters and is never stored: without it the file cannot be opened. The file is written readable only by you; an existing file is replaced only if it is itself a vault file. Encryption uses libsodium (scrypt key derivation, XSalsa20-Poly1305) through the sodium package.

Examples

vault <- cg_vault()
tokenise("PAN ABCPE1234F", vault)
#> [1] "PAN [PAN_1]"
path <- tempfile(fileext = ".cgvault")
vault_save(vault, path, passphrase = "an example passphrase")

# later, possibly in another session or in Python:
vault <- vault_open(path, passphrase = "an example passphrase")
restore("Customer [PAN_1] called.", vault)
#> [1] "Customer ABCPE1234F called."