Encryption & Security Tools
Relevant source files
The following files were used as context for generating this wiki page:
Encryption and security tools in the hyperdrive project provide mechanisms for protecting sensitive information, such as API tokens and credentials, through symmetric encryption and automated shell scripts. The project primarily utilizes GnuPG (GPG) for file-level encryption and Python's cryptography library for programmatic data protection.
These tools are essential for managing environment variables and secrets (e.g., IEXCloud, Polygon, and Binance API keys) that power the library's data collection and trading execution capabilities.
Sources: README.md:46-52, util/encrypt.sh:11
Secret Management and Environment Configuration
The project relies on a config.env file to store sensitive environment variables. These variables are loaded into scripts to facilitate authentication with external providers and to serve as passphrases for encryption routines.
| Variable Name | Purpose | Usage |
|---|---|---|
RH_PASSWORD | Passphrase for encryption | Used by GPG and Python encryption scripts |
SALT | Salt for key derivation | Used by Scrypt KDF in Python scripts |
IEXCLOUD | API Token | Authentication for IEXCloud data source |
POLYGON | API Token | Authentication for Polygon data source |
BINANCE | API Token | Authentication for Binance exchange |
Sources: util/encrypt.py:10-12, util/decrypt.py:10-12, README.md:46-52
Python-Based Encryption Framework
The project implements a symmetric encryption layer using the cryptography library. This system utilizes the Scrypt Key Derivation Function (KDF) to generate a secure key from a user-provided password and salt.
Key Derivation and Fernet Implementation
The encryption logic uses the following parameters for the Scrypt KDF:
- Length: 32 bytes
- n (Cost factor): 2^14
- r (Block size): 8
- p (Parallelization): 1
The derived key is then encoded in base64 to be used with the Fernet symmetric encryption algorithm, which guarantees that a message encrypted with it cannot be read or modified without the key.
Sources: util/encrypt.py:14-23, util/decrypt.py:14-23
Encryption/Decryption Data Flow
The following diagram illustrates the flow of data when transforming a plaintext file into an encrypted .encrypted file and back.
The Python tools read a filename either from an environment variable FILE or from command-line arguments.
Sources: util/encrypt.py:13, util/decrypt.py:13
Shell-Based GPG Encryption
In addition to Python scripts, the project provides Bash utilities for file encryption using GnuPG. These scripts are designed for quick manual use or integration into developer workflows, such as VSCode extensions.
util/encrypt.sh and util/decrypt.sh
These scripts use the AES256 cipher algorithm with a symmetric passphrase defined in RH_PASSWORD. The encrypt.sh script specifically targets the creation of .gpg files.
# Encryption command
gpg --batch --yes --symmetric --cipher-algo AES256 --passphrase=${RH_PASSWORD} --output "${FILE}.gpg" "${FILE}"
Sources: util/encrypt.sh:11, util/decrypt.sh:10
Token Synchronization (util/sync.sh)
The sync.sh script manages the synchronization of sensitive files (specifically robinhood.pickle) between Windows and Linux environments (WSL). After identifying the most recent version of the token, it performs GPG encryption to secure the file within the project directory.
Sources: util/sync.sh:10-22, util/sync.sh:37
Sources: util/sync.sh:10-37
Summary of Tools
| Tool | Implementation | Primary Output |
|---|---|---|
util/encrypt.py | Python (Fernet/Scrypt) | [filename].encrypted |
util/decrypt.py | Python (Fernet/Scrypt) | [filename] |
util/encrypt.sh | Bash (GPG AES256) | [filename].gpg |
util/decrypt.sh | Bash (GPG AES256) | [filename] |
util/sync.sh | Bash (Timestamp sync + GPG) | Encrypted OAuth tokens |
Sources: util/encrypt.py, util/encrypt.sh, util/decrypt.py, util/decrypt.sh, util/sync.sh
These tools ensure that sensitive market data source tokens and trading account credentials remain secure while allowing the hyperdrive library to operate across different environments and automation pipelines.
Sources: README.md:46-52, util/encrypt.sh:6-8