1

I have a file that will be encrypted at rest using GPG. I have the public and private keys for this file. I would like to send it to someone else. To do so, it must be encrypted using their (different) public key, so that they can decrypt it.

The easiest would be to: 1: decrypt with my key 2: write it to a temporary location 3: encrypt it with the other key

For security reasons, I can not write it to the temporary location because it won't be encrypted at that point. So, I would like to decrypt with my key and encrypt with the other key in one step, keeping the data in memory instead of writing it to a folder. Can this be done from the GPG command line?

I can't encrypt with my key and send them the public key to decrypt, it must start encrypted with my key and end up encrypted with their key.

6
  • A) You start with original (not encrypted) file. What do you mean by "1: decrypt with my key"? The file is not encrypted. How are you going to decrypt it?
    – mentallurg
    Apr 18 at 22:33
  • 2
    B) If you don't trust file system, then what is the reason to use this PC at all? Even if you keep sensitive data in memory, this memory piece can be written to a swap area on this disk.
    – mentallurg
    Apr 18 at 22:37
  • C) If you don't want to write unencrypted file to the disk, use a GPG library for your platform (C++, Java, Python, Go, etc.) Recommending any libraries is not allowed on this site. That's why I suggest to close this question.
    – mentallurg
    Apr 18 at 22:41
  • 1
    Essentially all operating systems today other than Windows support filesystems that are stored in memory, called (oxymoronically) a 'RAMdisk'. Put the temp file there and it's actually in memory -- although as @mentallurg says, practically all memory may get swapped to disk anyway. Apr 19 at 0:40
  • 1
    RAMdisk is a good idea, and as a side note you can temporarily disable swapfiles to mitigate disk-swapping that I believe.
    – belkarx
    Apr 19 at 3:51

2 Answers 2

0

One way to work around this on linux is using ramfs.

Create a temporary directory/mountpoint and then mount ramfs to it

mkdir /mnt/tmp
mount -t ramfs -o size=4 ramfs /mnt/tmp

Save the temporary file in /mnt/tmp. This file will remain in RAM. Take care, however, since if you save a very large file to the ramfs, it will consume all your memory and likely crash your system.

Once done, unmount it

umount /mnt/tmp
1
  • So, I'm on windows instead of linux but it sounds like I could to the same thing with power shell. 1: Create a temporary 'memory' disk 2: Decrypt to that location 3: Encrypt that file with the new key 4: Write the newly encrypted to the normal file location. This isn't a single command line, but it will be more straight forward than building a c# app.
    – Lindylead
    Apr 20 at 2:40
0

Not an expert here, but:

You could encrypt each file with a random symmetric key and save that key encrypted with your public key.

When you need to give access to the file, you need only decrypt the symmetric key and encrypt it with the recipient's public key.

2
  • 1
    The problem OP is trying to solve is to not have to decrypt the file on his storage first.
    – ThoriumBR
    Apr 19 at 17:02
  • @ThoriumBR Precisely. If the problem is about decrypting + encrypting a huge file, it can be solved by decrypting + encrypting a (small) symmetric key. Then he can share the encrypted file “as is”, no decryption necessary. If the OP does not want to reencrypt nothing at all, then I can't think how could this be done safely. Apr 20 at 7:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.