Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using GPG to Encrypt Your Data

nas.nasa.gov

Post reply on HN
Print view View original

31–40 of 100 posts

Re: Using GPG to Encrypt Your Data

#31

Post by davidcollantes »

larose wrote: post #15
jph wrote: post #8

For GPG symmetric encryption, the kind the article describes, here are the best options I've found for my typical case: gpg --symmetric \ --cipher-algo aes256 \ --digest-algo sha256 \ --cert-digest-algo sha256 \ --compress-algo none -z 0 \ --quiet --no-greeting \ --no-use-agent "$@" I keep this command here: https://github.com/SixArm/gpg-encrypt The options are chosen to balance tradeoffs of convenience, strength, an…

I did something similar to gpg-encrypt: https://github.com/larose/eef/ It's a wrapper for gpg to edit encrypted files.

Nice script, though I must note that it will only work on Linux. Tried it on macOS, but there is no `/dev/shm`.

Re: Using GPG to Encrypt Your Data

#32

Post by Wilya »

txutxu wrote: post #25
jph wrote: post #8

For GPG symmetric encryption, the kind the article describes, here are the best options I've found for my typical case: gpg --symmetric \ --cipher-algo aes256 \ --digest-algo sha256 \ --cert-digest-algo sha256 \ --compress-algo none -z 0 \ --quiet --no-greeting \ --no-use-agent "$@" I keep this command here: https://github.com/SixArm/gpg-encrypt The options are chosen to balance tradeoffs of convenience, strength, an…

Regarding the code... set -euf onecmd --args "$@" The set -u is unneeded, as there are no code variables involved. The set -e is not needed, as there is only one command, and the script will return the exit status of such command. Always. And will exit after that command. Always. The set -f, will disable globbing, which I'm not sure it's what you want, when using a simple wrapper passing "$@" as filenames to gpg...

Not the author of the code, but personally, I don't see any downside to putting "set -eu" at the beginning of every script I write. These should be defaults.

Re: Using GPG to Encrypt Your Data

#33

Post by ausjke »

throwawayish wrote: post #24
rakoo wrote: post #17

Earlier quoted context omitted.

Because the paragraph on key generation and management would be 3 times as long as the entire article in its current form ? Asymmetric encryption solves the problem of transmitting the password safely ("solve" is a rather optimistic word, maybe "delegates" is more appropriate); if you can safely transfer passwords from point to point, then using symmetric encryption is far easier.

Asymmetric cryptography transforms key distribution problems into key management problems. Which is just a different problem, not necessarily an easier one, like you say.

more importantly, they're more cpu intensive and slow to deal with large files

Re: Using GPG to Encrypt Your Data

#34

Post by nothrabannosir »

txutxu wrote: post #25
jph wrote: post #8

For GPG symmetric encryption, the kind the article describes, here are the best options I've found for my typical case: gpg --symmetric \ --cipher-algo aes256 \ --digest-algo sha256 \ --cert-digest-algo sha256 \ --compress-algo none -z 0 \ --quiet --no-greeting \ --no-use-agent "$@" I keep this command here: https://github.com/SixArm/gpg-encrypt The options are chosen to balance tradeoffs of convenience, strength, an…

Regarding the code... set -euf onecmd --args "$@" The set -u is unneeded, as there are no code variables involved. The set -e is not needed, as there is only one command, and the script will return the exit status of such command. Always. And will exit after that command. Always. The set -f, will disable globbing, which I'm not sure it's what you want, when using a simple wrapper passing "$@" as filenames to gpg...

I disagree. set -eu should be at the top of every bash script.

This is the classic braceless if-guard mistake; leave it out today because you don't need it, forget, add something tomorrow and it breaks.

Re: Using GPG to Encrypt Your Data

#35

Post by mundo »

LordKano wrote: post #14
HappyTypist wrote: post #5

Earlier quoted context omitted.

Is it really impossible for a human to follow? "Shiny C0rrect H0rse Battery Staple!"

That's a good long term solution but when policies force you to change your password every 45 days, it falls apart. In my experience, overly restrictive password policies force users to choose passwords that are less secure and easier to remember.

You can tell a company has this policy when every monitor has a sticky note on it with the numbers 1 to N on it, where 1 to N-1 are crossed out.

Re: Using GPG to Encrypt Your Data

#36

Post by acqq »

throwawayish wrote: post #21
tptacek wrote: post #20

Earlier quoted context omitted.

What is this getting you that a simple 'gpg -c' isn't? (I'm asking seriously; I don't have a strong opinion about GPG command line arguments)

The defaults he has chosen hints at a distro that ships GPG v1 / classic, which has stranger defaults than GPG v2. IIRC the default ciphers are CAST5, (very slow) compression is on by default, hashes are RIPEMD I believe and so on

Exactly. The defaults of GPG 1, the one which can be used as a single not-too-big binary, seem to be poor.

GPG 2 has better defaults, but it grew to include the kitchen sink and have a lot of moving parts, and I'd still prefer to have a good smaller program that does only a few things but do them good. My ideal would be a small executable with as little dependencies as possible.

Re: Using GPG to Encrypt Your Data

#37

Post by tptacek »

acqq wrote: post #36
throwawayish wrote: post #21

Earlier quoted context omitted.

The defaults he has chosen hints at a distro that ships GPG v1 / classic, which has stranger defaults than GPG v2. IIRC the default ciphers are CAST5, (very slow) compression is on by default, hashes are RIPEMD I believe and so on

Exactly. The defaults of GPG 1, the one which can be used as a single not-too-big binary, seem to be poor. GPG 2 has better defaults, but it grew to include the kitchen sink and have a lot of moving parts, and I'd still prefer to have a good smaller program that does only a few things but do them good. My ideal would be a small executable with as little dependencies as possible.

The GPG1 defaults are definitely not great, but I'm not sure they have much practical impact for this use case.

Re: Using GPG to Encrypt Your Data

#38

Post by oripel »

Key stretching is critical for password-based encryption, and gpg's s2k options are vulnerable to GPU acceleration. Command-line tools to encrypt with bcrypt/scrypt are common and may be a better option.

Re: Using GPG to Encrypt Your Data

#39

Post by necessity »

parfe wrote: post #2

>We suggest that you include five words of 5-10 letters in size, chosen at random, with spaces, special characters, and/or numbers embedded into words. >You need to be able to recall the passphrase that was used to encrypt the file. Why bother writing security guidelines which are impossible for a human to follow? edit: Try recalling any passphrases generated by the command below, and that's before the random sprinkl…

s/human/me
Post reply on HN