Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #194923

Re: encryption

From Brian <ad44@cityscape.co.uk>
Newsgroups linux.debian.user
Subject Re: encryption
Date 2018-04-21 17:30 +0200
Message-ID <vH2CB-7Gd-5@gated-at.bofh.it> (permalink)
References <vGK2Z-3Dx-1@gated-at.bofh.it> <vGOgh-6Fy-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Fri 20 Apr 2018 at 17:07:10 -0700, David Christensen wrote:

> On 04/20/18 12:38, Brian wrote:
> > T have a script. It contains an important password.
> > 
> > I have encrypted the script with
> > 
> >    scrypt dec -t 10 /usr/local/bin/myscript
> 
> Looking at:
> 
> http://manpages.org/scrypt
> 
> 
> That command decrypts /usr/local/bin/myscript (and I don't know if the -t
> option is valid for decryption).

A typo. It should be "enc", not "dec".
 
> > I can, of course, decrypt it with
> > 
> >    scrypt dec /usr/local/bin/myscript
> 
> Assuming /usr/local/bin/myscript is ciphertext, that command will print the
> script on STDOUT.

Another bit of sloppiness. Redirection to a file should have been
mentioned.
 
> As scrypt is going to prompt you for a passphrase anyway, why don't you
> leave the script unencrypted and revise it to prompt for the "important
> password"? 
> 
> > and then execute the script.
> 
> How are you executing a script printed on STDOUT?  A pipeline?

The redirected file was executed with 'eval'. 

> > The two last steps have been combined into
> > 
> >    DECRYPT=$(scrypt dec /usr/local/bin/myscript) && eval "$DECRYPT"
> > 
> > Should I have any more concerns with this command than I have with the
> > two-step process?
> 
> If the script is too big to fit in an environment variable, that would be a
> problem.

That passed through my mind. The script is 73 lines and, fortunately.
does fit. Putting the secret in a separate file is, however, a good way
to avoid that problem and the one of having trouble evaluating the
variable.
 
> Assuming the script fits into an environment variable, evaluating that
> variable in double-quoted context requires deep understanding of both your
> shell and the script (especially if the script is written for a different
> shell, and potentially a different version of the same shell).  If you're
> intent upon doing it this way, be sure to test thoroughly.
> 
> A pipeline would be more conventional-- decrypt the ciphertext and pipe the
> script to the appropriate interpreter.  Here is an example using Perl and
> the ccrypt tools:
> 
> 2018-04-20 16:59:50 dpchrist@vstretch ~/sandbox/ccrypt
> $ ll secret-script.pl
> -rwxr-xr-x 1 dpchrist dpchrist 66 2018/04/20 16:58:19 secret-script.pl*
> 
> 2018-04-20 17:00:02 dpchrist@vstretch ~/sandbox/ccrypt
> $ cat secret-script.pl
> #!/usr/bin/env perl
> print "The important password is 'secret'\n";
> 
> 2018-04-20 17:00:08 dpchrist@vstretch ~/sandbox/ccrypt
> $ ./secret-script.pl
> The important password is 'secret'
> 
> 2018-04-20 17:00:14 dpchrist@vstretch ~/sandbox/ccrypt
> $ ccencrypt --key foo secret-script.pl
> 
> 2018-04-20 17:00:26 dpchrist@vstretch ~/sandbox/ccrypt
> $ ll secret-script.pl.cpt
> -rwxr-xr-x 1 dpchrist dpchrist 98 2018/04/20 16:58:19 secret-script.pl.cpt*
> 
> 2018-04-20 17:00:30 dpchrist@vstretch ~/sandbox/ccrypt
> $ ll decrypt-run-secret.sh
> -rwxr-xr-x 1 dpchrist dpchrist 86 2018/04/20 16:57:27 decrypt-run-secret.sh*
> 
> 2018-04-20 17:00:40 dpchrist@vstretch ~/sandbox/ccrypt
> $ cat decrypt-run-secret.sh
> #!/usr/bin/env sh
> echo "The decryption key is 'foo'"
> ccat secret-script.pl.cpt | perl
> 
> 2018-04-20 17:00:51 dpchrist@vstretch ~/sandbox/ccrypt
> $ ./decrypt-run-secret.sh
> The decryption key is 'foo'
> Enter decryption key:
> The important password is 'secret'

I prototyped with gpg but ended up with scrypt because it is memory-hard
and slow to decrypt. That seemed to be an advantage; the decryption
passphrase could afford to be shorter and not give users here too much
to remember or type. I'll certainly take a look at what you suggest,
though.

That's two recommendations for putting the secret in a separate file;
I'll follow the advice. My concern was missing some important security
implication but that doesn't appear to be the case. Thanks to Greg
Wooledge and yourself.

-- 
Brian.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

encryption Brian <ad44@cityscape.co.uk> - 2018-04-20 21:40 +0200
  Re: encryption Greg Wooledge <wooledg@eeg.ccf.org> - 2018-04-20 22:00 +0200
  Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 02:10 +0200
    Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-21 17:30 +0200
      Re: encryption john doe <johndoe65534@mail.com> - 2018-04-21 17:40 +0200
        Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 22:00 +0200
          Re: encryption john doe <johndoe65534@mail.com> - 2018-04-22 08:30 +0200
            Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-22 20:30 +0200
      Re: encryption Glenn English <ghe2001@gmail.com> - 2018-04-21 19:00 +0200
        Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 22:30 +0200
      Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 21:50 +0200
        Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-22 18:20 +0200
          Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-22 18:50 +0200
            Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-23 10:50 +0200
              Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-23 13:20 +0200
                Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-24 20:50 +0200
  Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-21 18:40 +0200
    Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-21 20:20 +0200
      Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-21 21:00 +0200
        Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-21 21:20 +0200
          Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 23:30 +0200
          Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-22 04:30 +0200
            Re: encryption Curt <curty@free.fr> - 2018-04-22 11:20 +0200
              Re: encryption Reco <recoverym4n@gmail.com> - 2018-04-22 11:50 +0200
                Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-22 19:10 +0200
      Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 22:50 +0200
    Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 22:10 +0200
      Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-22 04:00 +0200
        Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-22 17:40 +0200
          Re: encryption Richard Hector <richard@walnut.gen.nz> - 2018-04-23 08:00 +0200
            Re: encryption Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-04-23 09:00 +0200
        Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-22 20:10 +0200

csiph-web