I want to be able to send my customer "firmware" updates to machines already sold to them. They aren't networked devices so it needs to be something done manually. Those hooks for getting the files onto the system are already in place.

I don't want them to be able to see the code in these updates, so I see two options:

  • Compress a directory of files to deploy. Encrypt that directory. Upload to device. Decrypt at device. Have a script manually deploy code where it needs to go.
  • Create a .deb package to let dpkg deal with deployment. Encrypt that package. Upload to device. Have a (simpler) script unpack the .deb package.

I'm leaning more towards the second option, as it feels cleaner. That being said, I don't have a lot of experience in security and want to do it as nicely as possible.

My first instinct is to do something like this answer for either case. I.E. using openssl to encrypt and decrypt on the respective sides.

BUT, is there a better way? Perhaps there's something in dpkg (or its relatives) that encrypts it in some specific way? Manually encrypting a package just feels wrong to me. Am I doing it correctly?


To clarify, my question is not necessarily a recommendation for what tool to use. I will use openssl unless otherwise enlightened. I am asking if using openssl is inferior to some other tool for this purpose, and to understand those difference, if applicable.

  • If they have indirect network connectivity, you could create your own repository for your specific packages and update via HTTPS going through an APT proxy. Jun 26, 2017 at 16:13
  • @RuiFRibeiro Clever. I will think about that one, thanks.
    – MD-7
    Jun 26, 2017 at 16:39

1 Answer 1


dpkg not intended to use encryption, so you need external tool.

Main question - where decryption key is stored and how it used.

It must be at least already stored in customer machine and used automatically by "firmware".

"firmware" must know how update itself from encrypted file.


In aspect of security GPG and OpenSSL look almost same, but mostly use incompatible formats and certificates. As security.stackexchange say.

About "manual" encryption. Must be good include package encryption in automated build process.

  • The specifics of using a common external crypto tool to suit my purpose is not a concern. I have edited my question (see edit 1) to clear possible confusion. Thanks for your answer.
    – MD-7
    Jun 26, 2017 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.