Security of bash script involving gpg symmetric encryption
7
votes
1
answer
4891
views
**Notice**: the very same vulnerability has been discussed in [this question](https://unix.stackexchange.com/q/400772/310237) , but the different setting of the problem (in my case I don't need to store the passphrase) allows for a different solution (*i.e.* using file descriptors instead of saving the passphrase in a file, see [ilkkachu's answer](https://unix.stackexchange.com/a/469641/310237)) .
Suppose I have a symmetrically encrypted file
my_file
(with gpg 1.x), in which I store some confidential data, and I want to edit it using the following script:
read -e -s -p "Enter passphrase: " my_passphrase
gpg --passphrase $my_passphrase --decrypt $my_file | stream_editing_command | gpg --yes --output $my_file --passphrase $my_passphrase --symmetric
unset my_passphrase
Where stream_editing_command
substitutes/appends something to the stream.
**My question**: is this safe? Will the variable $my_passphrase
and/or the decrypted output be visible/accessible in some way? If it isn't safe, how should I modify the script?
Asked by francescop21
(318 rep)
Sep 17, 2018, 09:33 AM
Last activity: Jun 30, 2021, 05:24 PM
Last activity: Jun 30, 2021, 05:24 PM