Considering using echo -n "passphrase" | gpg --batch --passphrase-fd 0 ... inside of Bash script (which should mitigate leaking passphrase to process list given echo is a built-in command, right?).

I need to know passphrase to create shares of it using Shamir Secret Sharing later in the script.

How can I supply string to encrypt to GnuPG? I usually use stdin for that.

Edit: following script appears to achieve what I want, but is it secure*?

*Passphrase and string are not leaked to other users nor written to file system and passphrase is cleared from memory once script exits.

*Script would run as non-admin with sudo privileges on read-only offline Raspberry Pi.

All feedback is welcomed as I might be naively considering an insecure approach.

#! /bin/bash

printf "%s\n" "Please type passphrase and press enter "

read -s passphrase

echo -n "bar" | gpg --batch --passphrase-fd 3 --s2k-mode 3 --s2k-count 65011712 --s2k-digest-algo sha512 --cipher-algo AES256 --symmetric --armor 3<<<"$passphrase"

According to ps ax, above script doesn’t leak passphrase to other users.

  • When you ask "Is it secure?" the counter-question always is "Secure from what?". What is the threat you're worrying about? – MechMK1 Apr 12 at 13:52
  • Thanks for helping out @MechMK1. Good point... I am looking for a way to achieve above without leaking passphrase or string to other users and without writing them to file system. I am aware above is likely not memory safe. – sunknudsen Apr 12 at 13:55
  • Having a hard time finding good docs for Bash here-string stored in file descriptor. According to this answer, here-strings are usually temporarily written to /tmp. – sunknudsen Apr 12 at 13:56
  • So, another user on the same machine? Limited? Or with root capabilities? – MechMK1 Apr 12 at 14:34
  • @MechMK1 I would like to avoid limiting the scope of this question too much as I am trying to learn as much as possible from you guys... Which threat models are obvious to your give the above script and use case? – sunknudsen Apr 12 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.