I am looking for a secure way to edit sensitive text data, using Git and Vim in the process.

An ideal solution would be:

  1. clone the encrypted git repository into memory;
  2. decrypt into memory;
  3. do the editing, in-memory;
  4. encrypt, in-memory;
  5. push back to the repository;
  6. remove from memory.

How can this setup be realized with the key requirement that no files ever touch persistent storage?

In my case, I'm using Windows 10, but I'm also interested how one would approach this on Linux.


RAMDisk Solved the in-memory part of the problem.

I'm currently looking into preventing the data from getting on disk, like @StevenUllrich mentioned in the comments, by using an encrypted swap- or page file.

  • How about simply using a RAM disk for this? It is kept in memory only and once you remove the disk its gone. The goal itself should probably also be achievable with a encrypted disk in a file which you can remove after use. Of course, you need to make sure that no temporary files from editing ever gets saved to the real disk. "Is there an implementation of a tool that, ..." - product recommendations are off-topic. – Steffen Ullrich May 5 '18 at 8:34
  • @SteffenUllrich That's exactly what I need, for step 3 and 6. :) I ended up using RAMDisk. I'm currently looking into steps 2 and 4; I'm also considering a certain 2FA construction. – Mussé Redi May 5 '18 at 9:05
  • At least on Linux you can also use full disk encryption with RAM disks. Of course, the decrypted content will end up in the RAM anyway since otherwise the editor could not work with it so it is questionable if encrypting the RAM disk is useful. But you should use an encrypted swap or page file since otherwise the content might end up on disk in clear anyway. – Steffen Ullrich May 5 '18 at 9:10
  • @SteffenUllrich My intention is to decrypt the files in the RAM, not the RAM disk itself. The purpose of encryption will be to secure the data on the git repository in the cloud. I'm currently looking into ways to, in some way, use the 2FA app on my phone to unlock encryption of the files via the command line. – Mussé Redi May 5 '18 at 9:16
  • @SteffenUllrich Could you elaborate on how use of an encrypted swap or page file is warranted for the content to stay off disk? – Mussé Redi May 5 '18 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.