0

I've been searching for days, but so far, no luck. Maybe I'm searching with the bad keywords.

I need to use GPG to decrypt encrypted file in memory, without writing decrypted contents to disk.

A third party software will call a script shell providing encrypted content as stdin and passphrase as a parameter. For test purpose only, I've read a shell variable

read pass

then I typed in my passphrase.

echo $pass | gpg  --passphrase-fd 0 --no-comment -q --no-verbose --decrypt fichier.chiffre.armor.gpg

this yields

You need a passphrase to unlock the secret key for
user: "Myself <fake@gpg-test.com>"
2048-bit RSA key, ID 5F65F788, created 2019-02-22 (main key ID C7E00AC4)

message secret

I wish to get only message secret, not the previous text related to decryption.

If I call echo $pass | gpg --passphrase-fd 0 --no-comment -q --no-verbose --output decrypted.txt --decrypt fichier.chiffre.armor.gpg the file decrypted.txtcontains only message secret

I've tried to use /dev/stdout as --output parameter, but it was a failure.

echo $pass | gpg  --passphrase-fd 0 --no-comment -q --no-verbose --output /dev/stdout --decrypt fichier.chiffre.armor.gpg


You need a passphrase to unlock the secret key for
user: "Myself <fake@gpg-test.com>"
2048-bit RSA key, ID 5F65F788, created 2019-02-22 (main key ID C7E00AC4)

File `/dev/stdout' exists. Overwrite? (y/N)

Any idea on how to this using GPG only ?

Thanks, Sebastien

  • What happened with --output & /dev/stdout that failed? – Xen2050 Feb 26 at 3:19
  • @Xen2050 the system ask me if I want to overwrite /dev/stdout I've edited my question with what happen You need a passphrase to unlock the secret key for user: "Myself <fake@gpg-test.com>" 2048-bit RSA key, ID 5F65F788, created 2019-02-22 (main key ID C7E00AC4) File `/dev/stdout' exists. Overwrite? (y/N)` – Sfnt Feb 26 at 8:24
0

My gpg doesn't seem to output info messages similar to yours, especially with -q, but anyway if as you say the only problem is you're getting extra messages from stderr, you can eliminate them (by redirecting stderr to /dev/null) by adding this to your command:

2>/dev/null

And you can go back to using stdout & don't have to worry about securely wiping any temporary files containing decrypted info.


[Also, --pinentry-mode loopback might be useful for avoiding some prompts]

0

actually the part

You need a passphrase to unlock the secret key for
user: "Myself <fake@gpg-test.com>"
2048-bit RSA key, ID 5F65F788, created 2019-02-22 (main key ID C7E00AC4)

isn't written on stdout.

When piping original command to sed 1,5d hoping to remove the first 5 lines, it just removed the cleartext message.

by redirecting the output to a file we got what we need :

myself@myhost:~/gpg$ echo $pass | gpg  --passphrase-fd 0 --no-comment -q --no-verbose --decrypt fichier.chiffre.armor.gpg > toto.txt


You need a passphrase to unlock the secret key for
user: "Myself <fake@gpg-test.com>"
2048-bit RSA key, ID 5F65F788, created 2019-02-22 (main key ID C7E00AC4)

myself@myhost:~/gpg$ cat toto.txt
message secret

I've confused stdout with what is written on the screen.

  • also using --no-ttydo exactly what I wanted at first – Sfnt Feb 26 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.