AutoEncryption

Last edit

Summary: Coalesce duplicate EasyPG sections. Put re-write of mc-gpg-file-mode.el as subsection.

Changed:

< At least in my emacs 23.1.1 that comes with Ubuntu 10.04 there is EasyPG Assistant that handles gpg encrypted files out-of-the-box. So (my) mc-gpg-file-mode is now obsolete.
< == stock emacs ==

to

> EasyPG is an all-in-one !GnuPG interface for Emacs. It has two aspects: convenient tools which allow to use !GnuPG from Emacs (!EasyPG Assistant), and a fully functional interface library to !GnuPG (!EasyPG Library).
> This library worked out of the box for me
. In contrast to most other approaches discussed here, easy-pg does not change the major mode.
> EasyPG Assistant is bundled with Emacs since version 23.1; it handles gpg encrypted files out-of-the-box so (my) mc-gpg-file-mode is now obsolete.
> == Mc-Auto-Encrypt ==
> You can get the code for this at Lisp:mc-auto-encrypt.el. This method takes advantage of the FileLocalVariables to evaluate a form, mc-auto-encrypt, and setup a before-save-hook and after-save-hook that handles the decryption and encryption. To start using it on a plain text file you need to put ##(require 'mc-auto-encrypt)## in your DotEmacs and then place this at the end of your unencrypt text file:
> <pre>
> Local Variables:
> eval:(mc-auto-encrypt)
> End:
> </pre>
> Using mc-auto-encrypt, the file is always displayed unencrypted. The buffer's modification state reflects the modification of the unencrypted text. When you save the file you are prompted (via MailCrypt) for the recipient. That should be at least you so that you can decrypt it later. You can also add additional recipients at this time if you want others to have access to the file. MailCrypt also prompts whether to sign the message or not. I'm not sure how much this matters if you're only encrypting it to yourself.
> Note that I've set mc-password-timeout to a fairly large value so I'm not prompted for my (complicated to type) GnuPG pass phrase every time I save the file. I'm not totally paranoid. I just want some reasonable way to protect my hosts, usernames, and passwords if my laptop were stolen.
> This method of auto encryption makes no more efforts than MailCrypt to protect the unencrypted text from memory. In other words, I believe someone could extract the clear text of the file either from memory or from swap space. I don't know if emacs has a way to take advantage of the 'mlock' POSIX function to disable paging for memory locations.
> If you need to see the encrypted, ASCII guarded text in
emacs, you should adjust the value of enable-local-eval.
> This is known to work with mailcrypt version 3.5.8, GNU Emacs 21.2.2, and GnuPG 1.2.1
> == Mc-gpg-file-mode
==
> Based on MailCrypt there is Lisp:mc-gpg-file-mode.el which allows automatic decryption / encryption of files ending with '.gpg' at file open / save. This can e.g. be used to comfortably handle a gpg encrypted (ASCII) file with passwords or such 'secrets'.
> === rewrite using pgg ===
> Note that this requires emacs22+. This just a re-write of Lisp:mc-gpg-file-mode.el to use the built-in functions that emacs22+ now has.
> Also, because of the way ##pgg## operates, this does write out a temporary file to disk with the unencrypted contents. The file is quickly erased, but user beware.

Deleted:

< Note that this requires emacs22+. This just a re-write of Lisp:mc-gpg-file-mode.el to use the built-in functions that emacs22+ now has.
< Also, because of the way ##pgg## operates, this does write out a temporary file to disk with the unencrypted contents. The file is quickly erased, but user beware.
< == easy-pg ==
< EasyPG is an all-in-one !GnuPG interface for Emacs. It has two aspects: convenient tools which allow to use !GnuPG from Emacs (!EasyPG Assistant), and a fully functional interface library to !GnuPG (!EasyPG Library).
< This library worked out of the box for me. In contrast to most other approaches discussed here, easy-pg does not change the major mode.
< == Mc-Auto-Encrypt ==
< You can get the code for this at Lisp:mc-auto-encrypt.el. This method takes advantage of the FileLocalVariables to evaluate a form, mc-auto-encrypt, and setup a before-save-hook and after-save-hook that handles the decryption and encryption. To start using it on a plain text file you need to put ##(require 'mc-auto-encrypt)## in your DotEmacs and then place this at the end of your unencrypt text file:
< <pre>
< Local Variables:
< eval:(mc-auto-encrypt)
< End:
< </pre>
< Using mc-auto-encrypt, the file is always displayed unencrypted. The buffer's modification state reflects the modification of the unencrypted text. When you save the file you are prompted (via MailCrypt) for the recipient. That should be at least you so that you can decrypt it later. You can also add additional recipients at this time if you want others to have access to the file. MailCrypt also prompts whether to sign the message or not. I'm not sure how much this matters if you're only encrypting it to yourself.
< Note that I've set mc-password-timeout to a fairly large value so I'm not prompted for my (complicated to type) GnuPG pass phrase every time I save the file. I'm not totally paranoid. I just want some reasonable way to protect my hosts, usernames, and passwords if my laptop were stolen.
< This method of auto encryption makes no more efforts than MailCrypt to protect the unencrypted text from memory. In other words, I believe someone could extract the clear text of the file either from memory or from swap space. I don't know if emacs has a way to take advantage of the 'mlock' POSIX function to disable paging for memory locations.
< If you need to see the encrypted, ASCII guarded text in emacs, you should adjust the value of enable-local-eval.
< This is known to work with mailcrypt version 3.5.8, GNU Emacs 21.2.2, and GnuPG 1.2.1
< == Mc-gpg-file-mode ==
< Based on MailCrypt there is Lisp:mc-gpg-file-mode.el which allows automatic decryption / encryption of files ending with '.gpg' at file open / save. This can e.g. be used to comfortably handle a gpg encrypted (ASCII) file with passwords or such 'secrets'.


Is it possible to edit encrypted files from inside Emacs? I’d like to keep a file encrypted on disk, and even better, never have the decrypted parts swapped out to disk. Has this already been done? --ShaeErisson

There are a few solutions for this.

EasyPG Assistant

EasyPG is an all-in-one GnuPG interface for Emacs. It has two aspects: convenient tools which allow to use GnuPG from Emacs (EasyPG Assistant), and a fully functional interface library to GnuPG (EasyPG Library).

This library worked out of the box for me. In contrast to most other approaches discussed here, easy-pg does not change the major mode.

EasyPG Assistant is bundled with Emacs since version 23.1; it handles gpg encrypted files out-of-the-box so (my) mc-gpg-file-mode is now obsolete.

Mc-Auto-Encrypt

You can get the code for this at Lisp:mc-auto-encrypt.el. This method takes advantage of the FileLocalVariables to evaluate a form, mc-auto-encrypt, and setup a before-save-hook and after-save-hook that handles the decryption and encryption. To start using it on a plain text file you need to put (require 'mc-auto-encrypt) in your DotEmacs and then place this at the end of your unencrypt text file:

 Local Variables:
 eval:(mc-auto-encrypt)
 End:

Using mc-auto-encrypt, the file is always displayed unencrypted. The buffer’s modification state reflects the modification of the unencrypted text. When you save the file you are prompted (via MailCrypt) for the recipient. That should be at least you so that you can decrypt it later. You can also add additional recipients at this time if you want others to have access to the file. MailCrypt also prompts whether to sign the message or not. I’m not sure how much this matters if you’re only encrypting it to yourself.

Note that I’ve set mc-password-timeout to a fairly large value so I’m not prompted for my (complicated to type) GnuPG pass phrase every time I save the file. I’m not totally paranoid. I just want some reasonable way to protect my hosts, usernames, and passwords if my laptop were stolen.

This method of auto encryption makes no more efforts than MailCrypt to protect the unencrypted text from memory. In other words, I believe someone could extract the clear text of the file either from memory or from swap space. I don’t know if emacs has a way to take advantage of the ‘mlock’ POSIX function to disable paging for memory locations.

If you need to see the encrypted, ASCII guarded text in emacs, you should adjust the value of enable-local-eval.

This is known to work with mailcrypt version 3.5.8, GNU Emacs 21.2.2, and GnuPG 1.2.1

Mc-gpg-file-mode

Based on MailCrypt there is Lisp:mc-gpg-file-mode.el which allows automatic decryption / encryption of files ending with ‘.gpg’ at file open / save. This can e.g. be used to comfortably handle a gpg encrypted (ASCII) file with passwords or such ‘secrets’.

rewrite using pgg

Note that this requires emacs22+. This just a re-write of Lisp:mc-gpg-file-mode.el to use the built-in functions that emacs22+ now has.

Also, because of the way pgg operates, this does write out a temporary file to disk with the unencrypted contents. The file is quickly erased, but user beware.

Add this to your .emacs file and any filename ending with .gpg will be treated as encrypted:

(defvar pgg-gpg-user-id "YOUR-ID-HERE")
(autoload 'pgg-make-temp-file "pgg" "PGG")
(autoload 'pgg-gpg-decrypt-region "pgg-gpg" "PGG GnuPG")
(define-generic-mode 'gpg-file-mode
  (list ?#) 
  nil nil
  '(".gpg\\'" ".gpg-encrypted\\'")
  (list (lambda ()
	    (add-hook 'before-save-hook
                      (lambda () 
                        (let ((pgg-output-buffer (current-buffer)))
                          (pgg-gpg-encrypt-region (point-min) (point-max)
                                                  (list pgg-gpg-user-id))))
                      nil t)
	    (add-hook 'after-save-hook 
		      (lambda ()
                        (let ((pgg-output-buffer (current-buffer)))
                          (pgg-gpg-decrypt-region (point-min) (point-max)))
			(set-buffer-modified-p nil)
			(auto-save-mode nil))
		      nil t)
            (let ((pgg-output-buffer (current-buffer)))
              (pgg-gpg-decrypt-region (point-min) (point-max)))
	    (auto-save-mode nil)
	    (set-buffer-modified-p nil)))
  "Mode for gpg encrypted files")

crypt++ and gnupg

CryptPlusPlus can also be used with GPG to automatically encrypt and decrypt buffers.

Another approach is to encrypt files transparently with emacs-wiki. See CryptPlusPlus.

auto-crypt (patch)

[Actually, crypt++ uses mailcrypt too.]
mc-auto-encrypt isn’t clean. Note particularly that it is likely to trash non-ASCII text, as is anything using Mailcrypt or crypt++. The right thing is to adapt auto-compression-mode to handle encryption with gpg, per Emacs TODO. Bundled diffs for what I use along that line are at auto-crypt.tgz. They involve a patched version of the PGG support code from a recent Gnus rather than using Mailcrypt (which can’t be included with Emacs). Actually, the right thing might be to use ‘format-alist’ entries for the job, but that interacts badly with what PGG does and happens at the wrong time for coding conversion.

ccrypt

See “Emacs Support” section on http://ccrypt.sourceforge.net/

This actually works over SSH.

Download source and
$ ./configure && make install

Current instructions on home page of how to enable in .emacs are wrong. Add this instead:

(setq load-path (cons "path" load-path)) ; where path is the path where ps-ccrypt.el is located
(require 'ps-ccrypt "ps-ccrypt.el")

Now, simply open a file you want to encrypt and save (C-x C-w) with “cpt” extension.

See also


CategoryFiles CategoryCryptography