Way to edit a password-protected file without having to retype the password all the time

encryptiongpgvim

I want to encrypt a text file using a password and a way to safely edit that file.

The problem I am having is that I haven't managed to find a simple way to do that while only requiring the password for the decryption process.


As recommended in this other question, I am currently trying to use gpg to encrypt my file and vim-gnupg to edit it.

The first alternative I tried was to encrypt with gpg --encrypt --default-recipient-self. This works well with vim-gnupg and gpg-agent in terms of not having to type the passphrase all the time but I find the use of assymetric crypto a bit cumbersome. Why do I need to create a key pair with my name and email and use assymetric crypto if all I am doing is encrypt things for myself? I'd also need to carry the key files with me instead of just the encrypted file.

The second alternative I tried was to encrypt with gpg --symmetric, which only asks for a passphrase. This time the problem was with not having to type the password over and over. When vim-gnupg saves the file it asks for a new password (and has me type it twice) instead of just reusing the same password that was used to decrypt the file in the first place. Is there a way to not do that?

Best Answer

The GPG man page has several options you're probably interested in, that you could work into your own personal decrypt-edit-encrypt script/function. Like:

  • --passphrase-fd n - Read the passphrase from file descriptor n
  • --passphrase-file file - Read the passphrase from file file... Obviously, a passphrase stored in a file is of questionable security if other users can read this file. Don't use this option if you can avoid it.
  • --passphrase string - Use string as the passphrase... Obviously, this is of very questionable security on a multi-user system. Don't use this option if you can avoid it.

Placing a keyfile in ram (tmpfs) and not readable by anyone else might be adequate. Or for Linux you could look into the kernel's key management facility i.e. keyctl

Related Question