Securely storing your secrets in R code

By Andrie de Vries

by Andrie de Vries

Last month I wrote about How to store and use webservice keys and authentication details, a summary of the options mentioned in a twitter discussion started by Jennifer Bryan. All of the options in my article really stored the secrets in plain text somewhere on your system, but in such a way to minimize the risk of accidentally publishing the secrets. Since then, I’ve had several comments (via twitter as well as the blog comments), about alternative options to really store your keys securely:

Using an encrypted disk

The first solution is to use an encrypted disk for the storage. As long as the encrypted disk is mounted, you work with the contents as if it is available in plain text. Thus, from the point of view of the R user, you simply store your secrets in “plain text” somewhere on the encrypted disk.

Using the digest package

The second alternative is to use the digest package, maintained by Dirk Eddelbuettel. Stephane Doyen provided the following solution:

1. I use the digest package that allows AES encryption.
2. I use a two functions one that write AES encrypted files, the other that read and decrypt those files. You can find those functions at github
3. Finally, I use the digest package to generate the key required to encrypt and decrypt files.
4. Once all of this is in place I create a dataframe that contains the login and the password.
5. I use the write.aes() function to write the credential locally in an encrypted file
6. The read.aes() allows to decrypt the credentials and import it in R

That way no credential appears in plain text or in the code. Additionally, one could decide to store the key elsewhere (remote server, usb drive, ect..). Also, this solution does not require to prompt for password each time.

Stephane provides this sample code to illustrate:

source("crypt.R")

load("key.RData")
credentials  ...read more
Source:: r-bloggers.com