Groups > linux.debian.user > #194917

Re: encryption

From	David Christensen <dpchrist@holgerdanske.com>
Newsgroups	linux.debian.user
Subject	Re: encryption
Date	2018-04-21 02:10 +0200
Message-ID	<vGOgh-6Fy-5@gated-at.bofh.it> (permalink)
References	<vGK2Z-3Dx-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 04/20/18 12:38, Brian wrote:
> T have a script. It contains an important password.
> 
> I have encrypted the script with
> 
>    scrypt dec -t 10 /usr/local/bin/myscript

Looking at:

http://manpages.org/scrypt

That command decrypts /usr/local/bin/myscript (and I don't know if the 
-t option is valid for decryption).

> I can, of course, decrypt it with
> 
>    scrypt dec /usr/local/bin/myscript

Assuming /usr/local/bin/myscript is ciphertext, that command will print 
the script on STDOUT.

As scrypt is going to prompt you for a passphrase anyway, why don't you 
leave the script unencrypted and revise it to prompt for the "important 
password"?

> and then execute the script.

How are you executing a script printed on STDOUT?  A pipeline?

> The two last steps have been combined into
> 
>    DECRYPT=$(scrypt dec /usr/local/bin/myscript) && eval "$DECRYPT"
> 
> Should I have any more concerns with this command than I have with the
> two-step process?

If the script is too big to fit in an environment variable, that would 
be a problem.

Assuming the script fits into an environment variable, evaluating that 
variable in double-quoted context requires deep understanding of both 
your shell and the script (especially if the script is written for a 
different shell, and potentially a different version of the same shell). 
  If you're intent upon doing it this way, be sure to test thoroughly.

A pipeline would be more conventional-- decrypt the ciphertext and pipe 
the script to the appropriate interpreter.  Here is an example using 
Perl and the ccrypt tools:

2018-04-20 16:59:50 dpchrist@vstretch ~/sandbox/ccrypt
$ ll secret-script.pl
-rwxr-xr-x 1 dpchrist dpchrist 66 2018/04/20 16:58:19 secret-script.pl*

2018-04-20 17:00:02 dpchrist@vstretch ~/sandbox/ccrypt
$ cat secret-script.pl
#!/usr/bin/env perl
print "The important password is 'secret'\n";

2018-04-20 17:00:08 dpchrist@vstretch ~/sandbox/ccrypt
$ ./secret-script.pl
The important password is 'secret'

2018-04-20 17:00:14 dpchrist@vstretch ~/sandbox/ccrypt
$ ccencrypt --key foo secret-script.pl

2018-04-20 17:00:26 dpchrist@vstretch ~/sandbox/ccrypt
$ ll secret-script.pl.cpt
-rwxr-xr-x 1 dpchrist dpchrist 98 2018/04/20 16:58:19 secret-script.pl.cpt*

2018-04-20 17:00:30 dpchrist@vstretch ~/sandbox/ccrypt
$ ll decrypt-run-secret.sh
-rwxr-xr-x 1 dpchrist dpchrist 86 2018/04/20 16:57:27 decrypt-run-secret.sh*

2018-04-20 17:00:40 dpchrist@vstretch ~/sandbox/ccrypt
$ cat decrypt-run-secret.sh
#!/usr/bin/env sh
echo "The decryption key is 'foo'"
ccat secret-script.pl.cpt | perl

2018-04-20 17:00:51 dpchrist@vstretch ~/sandbox/ccrypt
$ ./decrypt-run-secret.sh
The decryption key is 'foo'
Enter decryption key:
The important password is 'secret'

David

Thread

encryption Brian <ad44@cityscape.co.uk> - 2018-04-20 21:40 +0200
  Re: encryption Greg Wooledge <wooledg@eeg.ccf.org> - 2018-04-20 22:00 +0200
  Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 02:10 +0200
    Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-21 17:30 +0200
      Re: encryption john doe <johndoe65534@mail.com> - 2018-04-21 17:40 +0200
        Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 22:00 +0200
          Re: encryption john doe <johndoe65534@mail.com> - 2018-04-22 08:30 +0200
            Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-22 20:30 +0200
      Re: encryption Glenn English <ghe2001@gmail.com> - 2018-04-21 19:00 +0200
        Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 22:30 +0200
      Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 21:50 +0200
        Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-22 18:20 +0200
          Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-22 18:50 +0200
            Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-23 10:50 +0200
              Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-23 13:20 +0200
                Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-24 20:50 +0200
  Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-21 18:40 +0200
    Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-21 20:20 +0200
      Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-21 21:00 +0200
        Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-21 21:20 +0200
          Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 23:30 +0200
          Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-22 04:30 +0200
            Re: encryption Curt <curty@free.fr> - 2018-04-22 11:20 +0200
              Re: encryption Reco <recoverym4n@gmail.com> - 2018-04-22 11:50 +0200
                Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-22 19:10 +0200
      Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 22:50 +0200
    Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 22:10 +0200
      Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-22 04:00 +0200
        Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-22 17:40 +0200
          Re: encryption Richard Hector <richard@walnut.gen.nz> - 2018-04-23 08:00 +0200
            Re: encryption Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-04-23 09:00 +0200
        Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-22 20:10 +0200

csiph-web