Encrypt tar file asymmetrically

Question

I want to achieve something like

tar -c directory | openssl foo > encrypted_tarfile.dat

I need the openssl tool to use public key encryption.

I found an earlier question about symmetric encryption at the command promt (sic!), which does not suffice. I did take a look in the openssl(1) man page and only found symmetric encryption. Does openssl really not support asymmetric encryption?

Basically many users are supposed to create their encrypted tar files and store them in a central location, but only few are allowed to read them.

Answer 1

OpenSSL's asymmetric encryption routines lie under the rsautl subcommand. (In recent versions of OpenSSL, this has been superseded by the pkeyutl command, but the arguments seem to be the same.)

Encrypt a tar file using someone's public key:

openssl rsautl -encrypt -inkey Bob.pub -pubin -in foo.tar -out foo.tar.enc

They can then decrypt the tar file using their private key:

openssl rsautl -decrypt -inkey Bob -in foo.tar.enc -out foo.tar

Do note that SSH and SSL use different key formats, so if you want to use an SSH key for the encryption/decryption, you can't just use ~/.ssh/id_rsa.pub as-is.

Answer 2

Use gpg --encrypt.

With "-r" you can pass the user ID.

See

man gpg

Answer 3

In case you don't want to set gpg infrastructure, and just want to encrypt file using public/private key pair, the following tool could be of use: https://github.com/galets/AsymmetricCrypt . You will need mono on linux to run it.

disclaimer: I wrote it

Answer 4

Here are 2 examples from man openssl:

Send encrypted mail using triple DES:

 openssl smime -encrypt -in in.txt -from [e-mail] \
        -to someone@somewhere -subject "Encrypted message" \
        -des3 user.pem -out mail.msg
Sign and encrypt mail:

 openssl smime -sign -in ml.txt -signer my.pem -text \
        | openssl smime -encrypt -out mail.msg \
        -from [e-mail] -to someone@somewhere \
        -subject "Signed and Encrypted message" -des3 user.pem

Some confusion comes from the fact that s/mime and des3 are mentioned. But in fact the following happens in the examples above:

• A fresh random symmetric key is generated
• The file is encrypted using the symmetric key
• The symmetric key is encrypted using an asymmetric algorithm with a public key stored in user.pem
• The encrypted symmetric key, the encrypted file and metadata are put into a standard container

The end result is that in.txt file is encrypted into mail.msg file so only the user having the private key matching user.pem public key can decrypt it.