Is there a way to edit a password-protected file without having to retype the password all the time?

Question

I want to encrypt a text file using a password and a way to safely edit that file.

The problem I am having is that I haven't managed to find a simple way to do that while only requiring the password for the decryption process.

---

As recommended in this other question, I am currently trying to use gpg to encrypt my file and vim-gnupg to edit it.

The first alternative I tried was to encrypt with gpg --encrypt --default-recipient-self. This works well with vim-gnupg and gpg-agent in terms of not having to type the passphrase all the time but I find the use of assymetric crypto a bit cumbersome. Why do I need to create a key pair with my name and email and use assymetric crypto if all I am doing is encrypt things for myself? I'd also need to carry the key files with me instead of just the encrypted file.

The second alternative I tried was to encrypt with gpg --symmetric, which only asks for a passphrase. This time the problem was with not having to type the password over and over. When vim-gnupg saves the file it asks for a new password (and has me type it twice) instead of just reusing the same password that was used to decrypt the file in the first place. Is there a way to not do that?

Answer 1

The GPG man page has several options you're probably interested in, that you could work into your own personal decrypt-edit-encrypt script/function. Like:

• --passphrase-fd n - Read the passphrase from file descriptor n
• --passphrase-file file - Read the passphrase from file file... Obviously, a passphrase stored in a file is of questionable security if other users can read this file. Don't use this option if you can avoid it.
• --passphrase string - Use string as the passphrase... Obviously, this is of very questionable security on a multi-user system. Don't use this option if you can avoid it.

Placing a keyfile in ram (tmpfs) and not readable by anyone else might be adequate. Or for Linux you could look into the kernel's key management facility i.e. keyctl

Answer 2

I don't know of any way to do what you want with the standard tools.

That said, a really simple wrapper script could accomplish this.

Alternatively, if youre on Linux, you can use pyrite, which is a GUI wrapper for gpg & openssl. With it, you can type your password into the GUI a single time to decrypt, edit the decrypted text, and then press a button to re-encrypt (which uses the same passphrase).