5

I want to encrypt a text file using a password and a way to safely edit that file.

The problem I am having is that I haven't managed to find a simple way to do that while only requiring the password for the decryption process.


As recommended in this other question, I am currently trying to use gpg to encrypt my file and vim-gnupg to edit it.

The first alternative I tried was to encrypt with gpg --encrypt --default-recipient-self. This works well with vim-gnupg and gpg-agent in terms of not having to type the passphrase all the time but I find the use of assymetric crypto a bit cumbersome. Why do I need to create a key pair with my name and email and use assymetric crypto if all I am doing is encrypt things for myself? I'd also need to carry the key files with me instead of just the encrypted file.

The second alternative I tried was to encrypt with gpg --symmetric, which only asks for a passphrase. This time the problem was with not having to type the password over and over. When vim-gnupg saves the file it asks for a new password (and has me type it twice) instead of just reusing the same password that was used to decrypt the file in the first place. Is there a way to not do that?

2
  • Btw, the reason I am using gpg here instead of vim's built-in encryption feature (or something similar) is that I will want to be able to access the encrypted file from other scripts, and gpg is going to be better for that.
    – hugomg
    Apr 24, 2015 at 23:01
  • 1
    Beware of security issues Sep 19, 2018 at 8:34

2 Answers 2

2

The GPG man page has several options you're probably interested in, that you could work into your own personal decrypt-edit-encrypt script/function. Like:

  • --passphrase-fd n - Read the passphrase from file descriptor n
  • --passphrase-file file - Read the passphrase from file file... Obviously, a passphrase stored in a file is of questionable security if other users can read this file. Don't use this option if you can avoid it.
  • --passphrase string - Use string as the passphrase... Obviously, this is of very questionable security on a multi-user system. Don't use this option if you can avoid it.

Placing a keyfile in ram (tmpfs) and not readable by anyone else might be adequate. Or for Linux you could look into the kernel's key management facility i.e. keyctl

1
  • Here is an updated and more in-depth version of this answer (always by Xen2050). Sep 14, 2018 at 16:20
1

I don't know of any way to do what you want with the standard tools.

That said, a really simple wrapper script could accomplish this.

Alternatively, if youre on Linux, you can use pyrite, which is a GUI wrapper for gpg & openssl. With it, you can type your password into the GUI a single time to decrypt, edit the decrypted text, and then press a button to re-encrypt (which uses the same passphrase).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .