5

I want to encrypt a text file using a password and a way to safely edit that file.

The problem I am having is that I haven't managed to find a simple way to do that while only requiring the password for the decryption process.


As recommended in this other question, I am currently trying to use gpg to encrypt my file and vim-gnupg to edit it.

The first alternative I tried was to encrypt with gpg --encrypt --default-recipient-self. This works well with vim-gnupg and gpg-agent in terms of not having to type the passphrase all the time but I find the use of assymetric crypto a bit cumbersome. Why do I need to create a key pair with my name and email and use assymetric crypto if all I am doing is encrypt things for myself? I'd also need to carry the key files with me instead of just the encrypted file.

The second alternative I tried was to encrypt with gpg --symmetric, which only asks for a passphrase. This time the problem was with not having to type the password over and over. When vim-gnupg saves the file it asks for a new password (and has me type it twice) instead of just reusing the same password that was used to decrypt the file in the first place. Is there a way to not do that?

2
  • Btw, the reason I am using gpg here instead of vim's built-in encryption feature (or something similar) is that I will want to be able to access the encrypted file from other scripts, and gpg is going to be better for that.
    – hugomg
    Commented Apr 24, 2015 at 23:01
  • 1
    Beware of security issues Commented Sep 19, 2018 at 8:34

3 Answers 3

2

The GPG man page has several options you're probably interested in, that you could work into your own personal decrypt-edit-encrypt script/function. Like:

  • --passphrase-fd n - Read the passphrase from file descriptor n
  • --passphrase-file file - Read the passphrase from file file... Obviously, a passphrase stored in a file is of questionable security if other users can read this file. Don't use this option if you can avoid it.
  • --passphrase string - Use string as the passphrase... Obviously, this is of very questionable security on a multi-user system. Don't use this option if you can avoid it.

Placing a keyfile in ram (tmpfs) and not readable by anyone else might be adequate. Or for Linux you could look into the kernel's key management facility i.e. keyctl

1
  • Here is an updated and more in-depth version of this answer (always by Xen2050). Commented Sep 14, 2018 at 16:20
1

I don't know of any way to do what you want with the standard tools.

That said, a really simple wrapper script could accomplish this.

Alternatively, if youre on Linux, you can use pyrite, which is a GUI wrapper for gpg & openssl. With it, you can type your password into the GUI a single time to decrypt, edit the decrypted text, and then press a button to re-encrypt (which uses the same passphrase).

0

Suggest to setup a USB security key, I've written my own utility with-crypt which makes it trivial to edit files using a password that's accessed from a USB security key.

# Create a new blank test file.
PASSWORD=123 with-crypt --create --file=test.txt.enc
# Edit the file.
PASSWORD=123 with-crypt --file=test.txt.enc  nano {}

Or if you only want to view secrets:

PASSWORD=123 with-crypt --read-only --file=test.txt.enc  nano -v {}
  • You may want to setup aliases for for these as it's still a hassle to type out.
  • The password should not be part of the script/alias, instead use a command that accesses it securely or a prompt to type it in such as:
    PASSWORD="$(systemd-ask-password "Enter your password:")"
    For a USB security key such as a NitroKey:
    PASSWORD="$(nitropy nk3 secrets get-password my-pass --password)"
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .