0

We are using Symantec PGP encryption for AIX to encrypt/decrypt files. Keys are generated with passphrase and the passphrase are set by the business users. The IT admin is responsible to perform the encryption/decryption of files on monthly basis.

When decrypting files the passphrase has to be entered however as the IT admin does not have the passphrase (which is set by the business users), how can we address this? I think the passphrase has to be stored in a table or create a custom program for the decryption to pick up the relevant passphrase. Is there other ways to achieve this without the need for a custom program?

4

If any third party (such as the IT admin) needs to have access to the files in addition to the owner, the standard solution is to have the third party's public key on each user's keychain, and add the third party as a "recipient" of the file when encrypted. For example, user "userguy" might encrypt a file thus: pgp -se -r userguy -r itadmin a_file.example (that's actually GnuPG / gpg syntax but I believe PGP's command line syntax is compatible). The admin could then decrypt the file using their own private key (for which they'd have the passphrase), and - assuming the admin has every user's public key - re-encrypt the file (if needed) using the exact same command (changing the user's identity for each different user's files, of course).

PGP should come with an "agent" program that supports caching the decrypted (post-passphrase) key of the current user - such as the admin - in RAM, so the key only needs to be entered once per bootup. This is of course slightly riskier, since it increases the time the key spends in RAM and thus might be subject to hijacking by a malicious program or hardware attack (physical or via something like SPECTRE) - but it's a lot more convenient for somebody who has to decrypt and then re-sign (as part of re-encrypting) files all the time.

2
  • Thanks for your reply. You are correct there is an option to cache passphrase for a user session but we don't feel secure to have this cached in the system. Does this mean the only option is to build a custom program to store the user passphrase? Do you know of any custom program that I can consider?
    – userguy
    May 4 '20 at 6:10
  • 2
    I'm rather confused about why you "don't feel secure to have this cached in the system" but are open to building "a custom program to store the user passphrase". In what sense is that more secure than using a standard pgp-agent program that stores the key in RAM? With that said, there are other options. You can store PGP keys in a Yubikey or other hardware module, which makes them easy to use but hard for malicious software to steal (though they could be physically stolen). You can use OS-provided encryption on the key in addition to ACLs. Or people can just type passwords a lot.
    – CBHacking
    May 4 '20 at 10:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.