4 ms·

Vaguely related for people who want simple secure encryption tools is Age: https://github.com/FiloSottile/age https://github.com/FiloSottile/age

• tzs 6y ago
  How are people handling private keys in age? I don't really want my private key file just sitting around in plaintext. One obvious thing to do is to use age to encrypt that file with a passphrase. I had hoped that if you gave age a passphrase encrypt file in place of a plaintext private key file, it would recognize it and ask for the passphrase, but alas, it does not. So far, the only way I've found to do this without making a temporary copy of the plaintext private key on disk is to use a FIFO. Given a file, "input", encrypted to my public key, a file, "key.dat" containing my age private key encrypted with a passphrase, this decrypts "input" to the file "output": $ mkfifo f $ age -d -i f input > output & $ age -d key.dat > f ...age prompts for the key.dat passphrase... Another approach would be to make and mount a RAM disk, decrypt the public key to that, decrypt input, and then unmount and destroy the RAM disk, but that seems more bother, and also less portable. The FIFO trick should work on any modern Unix or Unix-like system. This is assuming I even want a key file. Age keys are quit small. Here's a private key it just made for me: "AGE-SECRET-KEY-15KMEW7TZY2T02V33ZM0MPH65CTTGHFY34DP2PDQDXFZGT3JU8GQQ5GDAYU" That's small enough that I'd be happy to store all my private keys in my password manager, and copy/paste from there when I need one. The FIFO trick can work with that: $ age -d -i f input > output & $ cat > k ...paste in the key... That echos the private key to the terminal, though, so maybe something like this? $ SAVE=$(stty -g) $ stty -echo $ age -d -i f input > output & $ echo "Paste the key, press RETURN, then control-D" $ cat > k $ stty $SAVE I suppose that can be turned into a little shell script, so not having direct support for encrypt private key files is not too annoying--at least on Unix and Unix-like systems. Is there a reasonable way to do this on Windows?
  • philsnow 6y ago
    process substitution might help you avoid an explicit fifo; it should work for this example but in general handling stdin can be tricky when using process substitutions. age -i <(age -d key.dat) -d input > output if you're using gnu pass to store private keys, you could do something like age -i <(pass age-key-personal) -d input > output