I want to encrypt a text file using a password and a way to safely edit that file.

The problem I am having is that I haven't managed to find a simple way to do that while only requiring the password for the decryption process.

As recommended in this other question, I am currently trying to use gpg to encrypt my file and vim-gnupg to edit it.

The first alternative I tried was to encrypt with gpg --encrypt --default-recipient-self. This works well with vim-gnupg and gpg-agent in terms of not having to type the passphrase all the time but I find the use of assymetric crypto a bit cumbersome. Why do I need to create a key pair with my name and email and use assymetric crypto if all I am doing is encrypt things for myself? I'd also need to carry the key files with me instead of just the encrypted file.

The second alternative I tried was to encrypt with gpg --symmetric, which only asks for a passphrase. This time the problem was with not having to type the password over and over. When vim-gnupg saves the file it asks for a new password (and has me type it twice) instead of just reusing the same password that was used to decrypt the file in the first place. Is there a way to not do that?

  • Btw, the reason I am using gpg here instead of vim's built-in encryption feature (or something similar) is that I will want to be able to access the encrypted file from other scripts, and gpg is going to be better for that. – hugomg Apr 24 '15 at 23:01
  • 1
    Beware of security issues – francescop21 Sep 19 '18 at 8:34

The GPG man page has several options you're probably interested in, that you could work into your own personal decrypt-edit-encrypt script/function. Like:

  • --passphrase-fd n - Read the passphrase from file descriptor n
  • --passphrase-file file - Read the passphrase from file file... Obviously, a passphrase stored in a file is of questionable security if other users can read this file. Don't use this option if you can avoid it.
  • --passphrase string - Use string as the passphrase... Obviously, this is of very questionable security on a multi-user system. Don't use this option if you can avoid it.

Placing a keyfile in ram (tmpfs) and not readable by anyone else might be adequate. Or for Linux you could look into the kernel's key management facility i.e. keyctl

  • Here is an updated and more in-depth version of this answer (always by Xen2050). – francescop21 Sep 14 '18 at 16:20

I don't know of any way to do what you want with the standard tools.

That said, a really simple wrapper script could accomplish this.

Alternatively, if youre on Linux, you can use pyrite, which is a GUI wrapper for gpg & openssl. With it, you can type your password into the GUI a single time to decrypt, edit the decrypted text, and then press a button to re-encrypt (which uses the same passphrase).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.