Considering using echo -n "passphrase" | gpg --batch --passphrase-fd 0 ...
inside of Bash script (which should mitigate leaking passphrase to process list given echo
is a built-in command, right?).
I need to know passphrase to create shares of it using Shamir Secret Sharing later in the script.
How can I supply string to encrypt to GnuPG? I usually use stdin
for that.
Edit: following script appears to achieve what I want, but is it secure*?
*Passphrase and string are not leaked to other users nor written to file system and passphrase is cleared from memory once script exits.
*Script would run as non-admin with sudo
privileges on read-only offline Raspberry Pi.
All feedback is welcomed as I might be naively considering an insecure approach.
#! /bin/bash
printf "%s\n" "Please type passphrase and press enter "
read -s passphrase
echo -n "bar" | gpg --batch --passphrase-fd 3 --s2k-mode 3 --s2k-count 65011712 --s2k-digest-algo sha512 --cipher-algo AES256 --symmetric --armor 3<<<"$passphrase"
According to ps ax
, above script doesn’t leak passphrase to other users.