How to type the password of a .gpg file only when opening it

Question

_{(I understand the security implications of the following, and I'm fine with them.)}

I have a single encrypted file in my org directory, diary.org.gpg. I never did any special configuration for it to work, still

1. Whenever I visit the file, I'm prompted for the encryption password. Which is great.
2. Whenever I save the buffer, I'm prompted for the password again twice. Which is my problem.

Note that I haven't configured anything for this to work, so any answers regarding agents or keyrings will have to come with configuration instructions.

I thought of keeping the password written somewhere inside the file (at the header or end-of-file comments). Then, whenever I save, Emacs could read the password in the buffer and use that instead of prompting me. But when I started looking into this, I got completely lost somewhere inside epa.el.

Q: How can I send a password directly from Emacs to the encryption system/process when saving the buffer, instead of being prompted for it?

All the rest (finding the password in the buffer) I can figure out myself. I just got lost when trying to understand how Emacs interfaced with gpg.

Note that I'm on Ubuntu, Arch Linux, and Windows. Which is why my first idea was an emacs-centric solution.
I can live with a solution that doesn't work on Windows, as long as I can still access the file on it in the manual way.

Answer 1

Encryption using password + key

This does not save the password directly in the file but does something similar without any security risk and helps you achieve what you want.

• You need to use asymmetric encryption so that your password is associated with an email ID in a keyring.

• Save the below at the top of your .gpg file

-*- epa-file-encrypt-to: ("your@email.address") -*-

The password is prompted the very first time the file is saved/created. But after that the password is prompted only once each time you open the saved file

The only catch is that you must not lose the keyring file which is saved in ~/.gnupg/ by default.

GPG Setup

Emacs Setup

No setup is needed to be done for this in emacs.

System Setup

But you do need to have your system environment ready with few libraries for the GPG feature to work.

At the time of setting this up, I had to install the following:

• gpgme-1.5.3
• libgpg-error-1.17
• libksba-1.3.2
• libassuan-2.2.0
• libgcrypt-1.6.2
• gnupg-2.0.26
• pinentry-0.9.0

I needed one or two of the above libraries and I ended up installing the others because they were either mandatory or optional dependencies.

Once everything is installed, do

> gpg --gen-key

And generate a never-expiring key for yourself and associate it with your real name and email.

The generated key will be saved in your ~/.gnupg/ directory.

Changing the keyring location

You can change the location of keyring by either changing $GNUPGHOME, using --homedir or --keyring options for gpg.

From man gpg:

--keyring file

Add file to the current list of keyrings. If file begins with a tilde and a slash, these are replaced by the $HOME directory. If the filename does not contain a slash, it is assumed to be in the GnuPG home directory ("~/.gnupg" if --homedir or $GNUPGHOME is not used).

Note that this adds a keyring to the current list. If the intent is to use the specified keyring alone, use --keyring along with --no-default-keyring.

Using GPG with emacs

In emacs, you simply create a file with a .gpg extension. For example, if the file was originally auth.el, you would rename it to auth.el.gpg.

Place this line at the top of the file:

;; -*- epa-file-encrypt-to: ("your@email.address") -*-

Note that I have used the elisp comment chars ;; as the example file here is auth.el.gpg.

Use the exact email address you used at the time of key generation.

When you try to save it, emacs will show this prompt in a buffer:

Select recipients for encryption.
If no one is selected, symmetric encryption will be performed.  
- `m' to mark a key on the line
- `u' to unmark a key on the line
[Cancel][OK]

  u <GPG KEY> <YOUR NAME> (<YOUR GPG KEY NAME>) <<YOUR GPG KEY EMAIL>>

Navigate the point to the line containing the key, hit m.

Navigate the point to the [OK] button and hit <return>.

You can now save the file and kill that file buffer.

Next time when you open that .gpg file, you will be prompted for the password only once and then consecutive saves will be password-prompt-free.

More info

• Here is one of the blog posts that talks about the emacs and GPG setup which you can refer as well.
• EasyPG - emacswiki.org

Answer 2

Turns out all I had to do was

(setq epa-file-cache-passphrase-for-symmetric-encryption t)

This solution works on both Linux and Windows, and is a courtesy of Ted and Michael over at help-gnu-emacs.

Answer 3

A more convenient way to encrypt files with key is to store encryption target in emacs directory local variable, so it applies to all org files in the directory

cat .dir-locals.el

((org-mode . ((epa-file-encrypt-to . <your-email>))))