Sample Header Ad - 728x90

Security of bash script involving gpg symmetric encryption

7 votes
1 answer
4891 views
**Notice**: the very same vulnerability has been discussed in [this question](https://unix.stackexchange.com/q/400772/310237) , but the different setting of the problem (in my case I don't need to store the passphrase) allows for a different solution (*i.e.* using file descriptors instead of saving the passphrase in a file, see [ilkkachu's answer](https://unix.stackexchange.com/a/469641/310237)) . Suppose I have a symmetrically encrypted file my_file (with gpg 1.x), in which I store some confidential data, and I want to edit it using the following script: read -e -s -p "Enter passphrase: " my_passphrase gpg --passphrase $my_passphrase --decrypt $my_file | stream_editing_command | gpg --yes --output $my_file --passphrase $my_passphrase --symmetric unset my_passphrase Where stream_editing_command substitutes/appends something to the stream. **My question**: is this safe? Will the variable $my_passphrase and/or the decrypted output be visible/accessible in some way? If it isn't safe, how should I modify the script?
Asked by francescop21 (318 rep)
Sep 17, 2018, 09:33 AM
Last activity: Jun 30, 2021, 05:24 PM