Encryption using password + key
This does not save the password directly in the file but does something similar without any security risk and helps you achieve what you want.
-*- epa-file-encrypt-to: ("[email protected]") -*-
The password is prompted the very first time the file is saved/created. But after that the password is prompted only once each time you open the saved file
The only catch is that you must not lose the keyring file which is saved in ~/.gnupg/
by default.
GPG Setup
Emacs Setup
No setup is needed to be done for this in emacs.
System Setup
But you do need to have your system environment ready with few libraries for the GPG feature to work.
At the time of setting this up, I had to install the following:
- gpgme-1.5.3
- libgpg-error-1.17
- libksba-1.3.2
- libassuan-2.2.0
- libgcrypt-1.6.2
- gnupg-2.0.26
- pinentry-0.9.0
I needed one or two of the above libraries and I ended up installing the others because they were either mandatory or optional dependencies.
Once everything is installed, do
> gpg --gen-key
And generate a never-expiring key for yourself and associate it with your real name and email.
The generated key will be saved in your ~/.gnupg/
directory.
Changing the keyring location
You can change the location of keyring by either changing $GNUPGHOME
, using --homedir
or --keyring
options for gpg
.
From man gpg
:
--keyring file
Add file to the current list of keyrings. If file begins with a tilde and
a slash, these are replaced by the $HOME directory. If the filename does
not contain a slash, it is assumed to be in the GnuPG home directory
("~/.gnupg" if --homedir or $GNUPGHOME is not used).
Note that this adds a keyring to the current list. If the intent is to use
the specified keyring alone, use --keyring along with --no-default-keyring.
Using GPG with emacs
In emacs, you simply create a file with a .gpg
extension. For example, if the file was originally auth.el
, you would rename it to auth.el.gpg
.
Place this line at the top of the file:
;; -*- epa-file-encrypt-to: ("[email protected]") -*-
Note that I have used the elisp comment chars ;;
as the example file here is auth.el.gpg
.
Use the exact email address you used at the time of key generation.
When you try to save it, emacs will show this prompt in a buffer:
Select recipients for encryption.
If no one is selected, symmetric encryption will be performed.
- `m' to mark a key on the line
- `u' to unmark a key on the line
[Cancel][OK]
u <GPG KEY> <YOUR NAME> (<YOUR GPG KEY NAME>) <<YOUR GPG KEY EMAIL>>
Navigate the point to the line containing the key, hit m
.
Navigate the point to the [OK]
button and hit <return>
.
You can now save the file and kill that file buffer.
Next time when you open that .gpg file, you will be prompted for the password only once and then consecutive saves will be password-prompt-free.
More info
gpg-agent
is that it is similarly tossh-agent
just stores the passwords you have, once you activate it. So you won't be prompted for the password neither when you open a file, nor when you save it (as long as the agent remembers the password), but I don't think this extends to the passphrase, which is kind of dumb, if true.gpg-agent
correctly, so that it caches the key for a while? :)