echo -n "passphrase" | gpg --batch --passphrase-fd 0 ... inside of Bash script (which should mitigate leaking passphrase to process list given
echo is a built-in command, right?).
I need to know passphrase to create shares of it using Shamir Secret Sharing later in the script.
How can I supply string to encrypt to GnuPG? I usually use
stdin for that.
Edit: following script appears to achieve what I want, but is it secure*?
*Passphrase and string are not leaked to other users nor written to file system and passphrase is cleared from memory once script exits.
*Script would run as non-admin with
sudo privileges on read-only offline Raspberry Pi.
All feedback is welcomed as I might be naively considering an insecure approach.
#! /bin/bash printf "%s\n" "Please type passphrase and press enter " read -s passphrase echo -n "bar" | gpg --batch --passphrase-fd 3 --s2k-mode 3 --s2k-count 65011712 --s2k-digest-algo sha512 --cipher-algo AES256 --symmetric --armor 3<<<"$passphrase"
ps ax, above script doesn’t leak passphrase to other users.