27

(I understand the security implications of the following, and I'm fine with them.)

I have a single encrypted file in my org directory, diary.org.gpg. I never did any special configuration for it to work, still

  1. Whenever I visit the file, I'm prompted for the encryption password. Which is great.
  2. Whenever I save the buffer, I'm prompted for the password again twice. Which is my problem.

Note that I haven't configured anything for this to work, so any answers regarding agents or keyrings will have to come with configuration instructions.

I thought of keeping the password written somewhere inside the file (at the header or end-of-file comments). Then, whenever I save, Emacs could read the password in the buffer and use that instead of prompting me. But when I started looking into this, I got completely lost somewhere inside epa.el.

Q: How can I send a password directly from Emacs to the encryption system/process when saving the buffer, instead of being prompted for it?

All the rest (finding the password in the buffer) I can figure out myself. I just got lost when trying to understand how Emacs interfaced with gpg.

Note that I'm on Ubuntu, Arch Linux, and Windows. Which is why my first idea was an emacs-centric solution.
I can live with a solution that doesn't work on Windows, as long as I can still access the file on it in the manual way.

10
  • I think this: orgmode.org/worg/org-tutorials/encrypting-files.html#sec-5 is what you want (the gpg-agent).
    – wvxvw
    May 7, 2015 at 10:41
  • @wvxvw Maybe. It doesn't say anything about saving, so I'll have to give it a try.
    – Malabarba
    May 7, 2015 at 10:46
  • To be honest, GPG and related programs have remarkably bad user interface. It's really hard to make sense of what they do from either interface or the documentation. But my understanding of the purpose of gpg-agent is that it is similarly to ssh-agent just stores the passwords you have, once you activate it. So you won't be prompted for the password neither when you open a file, nor when you save it (as long as the agent remembers the password), but I don't think this extends to the passphrase, which is kind of dumb, if true.
    – wvxvw
    May 7, 2015 at 10:50
  • You probably want to set up gpg-agent correctly, so that it caches the key for a while? :) May 7, 2015 at 11:43
  • 1
    @wvxvw Perhaps that used to be the case? I found said tools' man pages to be fairly detailed and the (CLI) interface is what one would usually expect from terminal-based programs.
    – legends2k
    Sep 16, 2018 at 15:58

3 Answers 3

19

Encryption using password + key

This does not save the password directly in the file but does something similar without any security risk and helps you achieve what you want.

  • You need to use asymmetric encryption so that your password is associated with an email ID in a keyring.

  • Save the below at the top of your .gpg file

-*- epa-file-encrypt-to: ("[email protected]") -*-

The password is prompted the very first time the file is saved/created. But after that the password is prompted only once each time you open the saved file

The only catch is that you must not lose the keyring file which is saved in ~/.gnupg/ by default.

GPG Setup

Emacs Setup

No setup is needed to be done for this in emacs.

System Setup

But you do need to have your system environment ready with few libraries for the GPG feature to work.

At the time of setting this up, I had to install the following:

  • gpgme-1.5.3
  • libgpg-error-1.17
  • libksba-1.3.2
  • libassuan-2.2.0
  • libgcrypt-1.6.2
  • gnupg-2.0.26
  • pinentry-0.9.0

I needed one or two of the above libraries and I ended up installing the others because they were either mandatory or optional dependencies.

Once everything is installed, do

> gpg --gen-key

And generate a never-expiring key for yourself and associate it with your real name and email.

The generated key will be saved in your ~/.gnupg/ directory.

Changing the keyring location

You can change the location of keyring by either changing $GNUPGHOME, using --homedir or --keyring options for gpg.

From man gpg:

--keyring file

Add file to the current list of keyrings. If file begins with a tilde and a slash, these are replaced by the $HOME directory. If the filename does not contain a slash, it is assumed to be in the GnuPG home directory ("~/.gnupg" if --homedir or $GNUPGHOME is not used).

Note that this adds a keyring to the current list. If the intent is to use the specified keyring alone, use --keyring along with --no-default-keyring.

Using GPG with emacs

In emacs, you simply create a file with a .gpg extension. For example, if the file was originally auth.el, you would rename it to auth.el.gpg.

Place this line at the top of the file:

;; -*- epa-file-encrypt-to: ("[email protected]") -*-

Note that I have used the elisp comment chars ;; as the example file here is auth.el.gpg.

Use the exact email address you used at the time of key generation.

When you try to save it, emacs will show this prompt in a buffer:

Select recipients for encryption.
If no one is selected, symmetric encryption will be performed.  
- `m' to mark a key on the line
- `u' to unmark a key on the line
[Cancel][OK]

  u <GPG KEY> <YOUR NAME> (<YOUR GPG KEY NAME>) <<YOUR GPG KEY EMAIL>>

Navigate the point to the line containing the key, hit m.

Navigate the point to the [OK] button and hit <return>.

You can now save the file and kill that file buffer.

Next time when you open that .gpg file, you will be prompted for the password only once and then consecutive saves will be password-prompt-free.

More info

7
  • 1
    If I lose the keyring file, will I still be able to open the encrypted file with the usual password or is it lost forever?
    – Malabarba
    May 7, 2015 at 11:11
  • @Malabarba I haven't tried that but I believe it's lost forever. But the good thing is that that file is generated only once when you associate an email and a password with a keyring element. It is not modified after that first time until you add more keyring elements (more password+email pairs). I simply keep backups of that file in a USB key and Dropbox and make sure that the password is super secure. May 7, 2015 at 11:25
  • I've tested the symmetrically encrypted documents to be portable. I encrypted something in emacs in Linux and opened it using one of the many free GPG decrypter tools available for windows. It asked for the keyring and pointed it to my backup in Dropbox and it worked. May 7, 2015 at 11:29
  • Just FYI: Yes, losing the key file means you permanently lose access to your encrypted files too. You need both the password and the private key file to unencrypt them. That's part of the GPG security model for asymmetric encryption.
    – Tyler
    May 7, 2015 at 17:09
  • Looks like I'll have to go with this answer after all. Do you know how I can change the location of the keyring file?
    – Malabarba
    May 11, 2015 at 12:17
16

Turns out all I had to do was

(setq epa-file-cache-passphrase-for-symmetric-encryption t)

This solution works on both Linux and Windows, and is a courtesy of Ted and Michael over at help-gnu-emacs.

5
  • Good to know that this works for you! I had this setting in my Emacs config for years, but at some point it just stopped working. I suspect that it has to do with my use of the gnome-keyring-daemon (which also acts as a gpg keyring).
    – paprika
    May 8, 2015 at 0:30
  • 7
    From the docstring for epa-file-cache-passphrase-for-symmetric-encryption: "Note that this option has no effect if you use GnuPG 2.0." Apr 24, 2016 at 14:57
  • @WilfredHughes here it works with GnuPG 2.2.12.
    – karlacio
    Feb 2, 2020 at 18:30
  • Works for me, but note that this only applies to whole-file encryption and not org-mode heading-based encryption. Also, see gnu.org/software/emacs/manual/html_node/epa/… for details on settings this up.
    – Digicrat
    Mar 1, 2020 at 5:06
  • 2
    IMO this should be the accepted answer. I don't want to encrypt some files using a GPG key, since there's a risk of losing the key and thus losing the file content forever (storing your private key in a hosted service like Dropbox, as suggested by the other answer, doesn't sound very wise). This solution still works with the newest GnuPG.
    – xji
    Apr 4, 2020 at 20:02
0

A more convenient way to encrypt files with key is to store encryption target in emacs directory local variable, so it applies to all org files in the directory

cat .dir-locals.el

((org-mode . ((epa-file-encrypt-to . <your-email>))))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.