0

I want to use GPG as a master password storage (encrypt and push to online storage). This would require encrypted file being able to be decrypted on multiple machines.

  • Two computers comp1 and comp2 with differing operating systems
  • Comp1 has a file, myfile.txt
  • This file will be stored encrypted on comp1
  • From my understanding, private key on comp1 will be used to encrypt myfile.txt

How are private keys stored with GPG. e.g. Best practices. If hd fails, private key is lost?

To decrypt on comp2, I could store private key on comp2 as well?

Any links to diagrams appreciated as I know the keys are also tied to emails and not sure how this fits in?

  • Any reason why you aren't considering a KDF and strong password? – user Jul 20 at 13:25
  • 2
    There is a Unix tool "pass" and modern derivates that do exactly this, and are built for multiple users. – multithr3at3d Jul 20 at 14:00
  • one user, multi-platform tool? – paulj Jul 20 at 14:54
  • 2
    GPG, multi-platform? Yes, but I often find myself pulling my hair out when dealing with subtle GPG issues on Windows. IMHO, a standalone multi-platform password manager would be better than a tool relying on a system GnuPG install. – Tony Aug 19 at 15:43
  • 1
    Why not use an offline password manager (off course encrypted), synchronized among your devices anyway you want? (For example, keepass works on linux, macos, windows, iphone, android, etc.) – A. Hersean Aug 19 at 15:48
1

With GPG the file is actually first encrypted using symmetric encryption, and the key used for that is then encrypted to every recipient using their public keys. Therefore, instead of transferring a single private key between the systems, it's possible to just encrypt the file with multiple recipients.

gpg --encrypt --recipient <comp1> --recipient <comp2> \
    --recipient <compN> passwords.txt

There are some caveats with this approach:

  • How any changes to your password database are synced between the systems. One would need to be able to act as a server, while the others might use e.g. rsync to syncronize the file. Password managers may provide service for this.
  • If any of the systems is compromised and the password file containing everything is decrypted, every password would be compromised. Software designed for password management have some solutions to minimize this risk e.g. by only decrypting one password at a time and trying to erase it from the memory as soon as possible.
  • As so many good solutions already exists, I wouldn't try and reinvent the wheel.
| improve this answer | |
  • Ok, I see why reinventing wheel might be problematic. I wanted to use tools GPG already on system. I am seeing KeePass (X/XC) are cross-platform. Nothing prevents KeePass encrypted database being kept in "cloud" and pulled/pushed between multiple platforms? – paulj Jul 20 at 15:02
  • 1
    @paulj yes, that is a common usage pattern for KeePass, whether cloud is "cloud" or something you are hosting. – multithr3at3d Jul 20 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.