Linux Security Cookbook [Electronic resources] نسخه متنی

Recipe 7.4 Encrypting Files with a Password

7.4.1 Problem

You want to encrypt a file so only you
can decrypt it with a password.

7.4.2 Solution

$ gpg -c filename

7.4.3 Discussion

Symmetric
encryption (-c)
is the simplest way to encrypt a file with gpg:
just provide a password at encryption time. To decrypt, provide the
password again.

By default, encrypted files are binary. To produce an ASCII text file
instead, add the -a (armor) option:

$ gpg -c -a filename

Binary encrypted files are created with the suffix
.gpg, whereas ASCII encrypted files
have the suffix .asc.

Though simple,

symmetric encryption has some gotchas:

• It's not practical for handling multiple files at
  once, as in scripts:

  A bad idea:
  #!/bin/sh
  for file in file1 file2 file3 ...
  do
  gpg -c "$file"
  done

  GnuPG will prompt for the password for

  each file
  during encryption and decryption. This is tedious and error-prone.
  Public-key encryption does not have this limitation, since no
  passphrase is needed to encrypt a file. [Recipe 7.6]
  Another strategy is to bundle the files into a single file using
  tar, then encrypt the
  tarball. [Recipe 7.18]




• If you mistype the password during encryption and
  don't realize it, kiss your data goodbye. You
  can't decrypt the file without the mistyped (and
  therefore unknown) password. gpg prompts you for
  the password twice, so there's less chance
  you'll mistype it, but
  GnuPG's public-key
  encryption leaves less opportunity to mistype a password unknowingly.




• It's not much good for sharing files securely, since
  you'd also have to share the secret password. Again,
  this is not true of public-key encryption.

7.4.4 See Also

gpg(1).