Best way to symmetrically encrypt multiple files using a password

Question

I would like to encrypt many files using symmetric encryption such as AES256, using a single memorised password.

I was planning to use gpg but gpg symmetric encryption does not work with --multifile flag. gpg has the ability to cache the passphrase during decryption, but I couldn't find this option for encryption.

What is the best way of doing this?

Conditions:

• Prefer using popular tools that have stood test of time in public. Ideally I would only use tools already shipped with linux
• It won't work for me to create a giant tarball and encrypt it. I need each file to be encrypted separately.
• I want to type the passphrase only once, not once per file.

Some solutions that seem to have drawbacks:

• use openssl cli not pgp - may have vulnerabilities in implementation of cryptography as claimed by users here
• use passphrase flag in gpg and store the passphrase in a file - not recommended as other people may have access to the computer in future and securely erasing the disk is non-trivial.
• use this script - I don't know if this code has bugs or can be accidentally misused.
• use pgp asymmetric encryption and export the encrypted private key. Everyone who has access to encrypted files will also have access to the encrypted private key. - This might be slightly slower but that is not an issue. It feels wrong, but this solution will work for me. I will consider this as worst case option.
• use 7zip (or a similar tool) - maintained only by one company and may be less secure or less portable compared to pgp or openssl. I will consider this as worst case option.

Answer 1

Conclusion: I just decided to use asymmetric encryption and export the (seedphrase-encrypted) private key so it is stored with the encrypted files.

I probably don't need to hunt for a complicated solution when the simple solution will work. If anyone here recommends against this, please let me know.

Answer 2

The following bash script fulfills your requirements:

#!/usr/bin/env bash

# Print usage information of the script
if (($# == 0)) || [[ "$1" == "--help" ]] || [[ "$1" == "-h" ]]; then
  echo "Usage: $0 <filename> [<filename> ...]"
  exit 1
fi

echo "Passphrase:"
# Disable output to prevent terminal leakage of passphrase when the passphrase is entered
stty -echo
# Read passphrase via standard input
# The "-r" parameter of read prevents the interpretation of escape sequences
# Setting the IFS (Internal Field Separator) environment variable empty to allow the passphrase to contain whitespaces
IFS="" read -r passphrase
# Enable output
stty echo

# Execute GnuPG to encrypt every file with AES-256 given as a parameter to the script
for arg in "$@"; do
  gpg --batch --symmetric --passphrase-fd 0 --cipher-algo AES256 "$arg" <<< "$passphrase"
done

• Save it as enc.sh and make it executable with chmod +x enc.sh.
• To encrypt multiple files, execute ./enc.sh file1 file2 ... and enter your passphrase which is required once.
• Files are encrypted with GnuPG using AES-256.
• The passphrase will not be leaked through the terminal, the shell history or /proc's cmdline.
• To decrypt a file execute gpg filename.gpg or use gpg --multifile --decrypt file1.gpg file2.gpg ... to decrypt multiple files at once.