How to store encrypted notes in a public git repository?

Question

I save my notes in a git repository in plaintext (markdown). Currently, the remote repository is another computer in my appartment. I am thinking about moving this remote repository to a remote server.

Description:

• I want this to be as simple as possible. As few external tools as possible.
  • Because of this, i don't want to use git-crypt, since it is very complex and I don't understand it good enough.
  • I also don't want to use git annex for the very same reason.
• The gitignore file of this repository would ignore every file besides *.asc files.
• To increase the simplicity I will not obfuscate the filename of the encrypted file. I plan to just be cautious about the filename and not put sensitive stuff inside the file.
• The encryption and decryption would be done with an asymmetric key, and this very asymmetric key would be also included in the repostiory, AES256 encrpyted.
• Maybe, I could also sign each commit with the asymmetric key which lies encrypted in the repository itself. That would prevent an attacker to manipulate something. But I also don't know if it is worth to do that?
• As my laptop has disk encryption, I don't care about plaintext files lying around in this repo (because I edit stuff inside, read them, etc.)
• Being a git repository, I could mirror it to multiple remote repositories.

For that, I have three questions:

1. Is this safe? Obviously random people will have access to my remote repository. Of course, I could make the repository private and not use github, gitlab or something like that - but the sysadmin of the server will have access to this repo, no matter what.

   • At least, I am not competent enough to, for instance, encrypt the filesystem in such a way that I can confidently say that this remote repository will be secure.

2. What key algorithms should I use? Should I use ed25519 (which I trust the most out of ECC's at the moment - although I just superficially read about it) Or should i use RSA 4096 or even bigger?

3. I do not know if I should use gpg2 or rage?

   • I dislike the complexity of gpg, but rage is a very young project. (And I dislike Golang, therefore I also dislike to use the its reference implementation age.)
   • I will never need the legacy options of gpg, so i will always be able to use version 2+.

Answer 1

The simplest answer would be to use a symmetric cipher (e.g. AES).

• You are the only user, so you only have to keep the AES key securely stored.
• Symmetrical algorithms are generally faster than asymmetrical ones (but probably not by much for text though).
• You use only one operation at encryption/decryption time.

Now for your questions:

1. Is this safe?

AES is still considered safe, but you have to take care with its mode and size. Regarding your use case, you should go with AES-256-CBC, as it might be easier to use than AES-256-GCM and more common than some recent ciphers.

2. What key algorithms should I use?

Well, as I said, symmetric only should do the trick.

3. I do not know if I should use gpg2 or rage?

OpenSSL could be use for AES (or many other ciphers), some example here.