I am working on a computer program that stores and retrieves secrets and needs to run without user interaction on the server.

I have successfully set everything up in my system to use gpg-agent to retrieve the cached passphrase without user interaction to encrypt and decrypt data with gpg2 --symmetric when I specify a file name.

However, this requires me to temporarily store my data on the disk without encryption. I do not want to put unencrypted data on my disk. So now I have changed things to work with STDIN and STDOUT rather than disk files.

The command I am testing with is this: cat test.txt | gpg2 --symmetric -o test.gpg.

The problem is that now it does not seem possible to get the passphrase cached and so I must enter it interactively each time. This will not work for my server program.

I have tried using gpg-preset-passphrase for this. I do not know if it is possible though because it wants a "KEYGRIP". One rough idea I have is this: maybe there is some default keygrip that gpg2 uses with --symmetric and STDIN. But I don't know if that idea will pan out.

I am not planning to specify a passphrase in my code with --passphrase because that means I need to store a secret in the code, which I am not going to do.. and it would allow anyone who could access the code to decrypt the files. It would also expose the passphrase on the command line.

I hope that it is clear enough what I am trying to achieve. Any ideas are appreciated.

  • How were you caching the passphrase initially? – Xen2050 Apr 22 at 7:42
  • gpg-agent does it when it has a file name. – Jason Livesay Apr 22 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.