I needed a decent solution to keep all my backup secured, so I checked out solutions online and I initially checked out GnuPG which is based on the OpenPGP specification , however I looked up a Golang library for that and I’ve read the deprecation message, it’s didn’t take me too long to find an interesting article about the flaws of that specification; not long after that I decided to stop encrypting my backup with GnuPG, I just felt it was just over engineered.
At the bottom of that article I came across Age File Encryption, my first impression was that the key pair the software generated are pretty short and yet still secure, so short that I can copy the public key and easily paste it into a shell script; on a Mac to run a shell script I can simply just double click on it, backup my stuff and encrypt it just like that.
The software itself is quite lightweight, I decided to install a copy on one of the servers (along with the public key) on the cloud, so I can encrypt it server side, so it effectively delivers an end to end encryption as I download the backup to my desktop (I’m also using SFTP). For when I do need to access the backup I can just simply decrypt it with a private key. There is no way I’m going to install GnuPG on my server, the key the software generate are way too long, therefore I just can’t copy the public key and put it into the shell script otherwise it will be a right mess and also I do not want to rely on the keychain, that itself add another layer of complexity that I’d rather not have, thanks but no thanks. Complexity is the bane of most software, that is not fun at all, never has been, never will.
Age is not over engineered, it’s does exactly what it says on the tin and that is ‘file encryption’ nothing more, nothing less, but GnuPG just tries to be more than that, does file encryption, handle signatures and hashing, also support different types of encryption and key types just for the sake of backward compatibility and because of that the software itself tend to be very difficult to maintain.
The process of generating key pairs.
Age
Let’s start with Age, it’s quite a simple process you just run the key generator and it’s won’t ask for any input.
$ age-keygen
# created: 2021-11-28T15:29:43Z
# public key: age1ksn4azh0feuys3kpmc230wjx7hew45aqpty6pnsxwcp9a6wwqgfsv4dsvn
AGE-SECRET-KEY-1YGSLFL2KWS4VNPGNWTPJLPND3XKQ5TAECN8C0WKWDX5JUPYSCK5QH3WQVG
If you want to write a to a file, it just the case of using the -o flag. I won’t be using those keys, obviously.
GnuPG
Let’s move onto GnuPG, first you run the command below.
gpg --full-generate-key
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
Your selection? 1
I chose one, the process is already more complicated and for the next question. The key size
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048)
I press enter for the default. The next one the expire
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0)
Again I press enter for default, then it ask you for your name, email address and additional comment.
GnuPG needs to construct a user ID to identify your key.
Real name: Best User
Email address: [email protected]
Comment: Best Company
You selected this USER-ID:
"Best User (Best Company) <[email protected]>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit?
I type O for Okay and then it’s generate the key pair, as soon as you share the public key to the world, your name and email will be exposed to the world. There is really no anonymity with OpenPGP. You can find an example of a public key here and it pretty long, it’s quite tedious to integrate with shell script.
Useful script I written for Age.
decrypt
#!/bin/dash
identity=""
for file in $HOME/.age/*/*.txt; do identity="$identity -i '$file'"; done
aged="age -d $identity"
for var in "$@"
do
eval "${aged} -o \"${var%.*}\" \"${var}\""
done
# Example usage: decrypt file1.zip.age file2.zip.age
I use that script to decrypt batches of file, I don’t have to worry about passing in the identity (or private key) as the script does all that work for me and therefore I don’t need to use a fancy keychain, I just use the file system that comes standard with every OS on the market.
ageRotateKey
#!/bin/dash
if [ $# -eq 0 ]; then
print >&2 "Usage: $0 need foldername"
exit 1
fi
folderName=$1
cp -r $HOME/.age/${folderName} $HOME/.age/.legacy/${folderName}-$(date '+%s')
for file in $HOME/.age/${folderName}/*.txt
do
rm $file
echo $file
age-keygen -o $file
done
# Example usage: ageRotateKey folderName
Hopefully I won’t have to use that script for awhile, but if one of my private key does get compromised or get outdated, I’ll run this script, it will copy my old keys to a new folder in legacy with timestamp appended to it and regenerate a new set of keys!
decryptLegacy
#!/bin/dash
identity=""
for file in $HOME/.age/.legacy/*/*.txt; do identity="$identity -i '$file'"; done
aged="age -d $identity"
for var in "$@"
do
eval "${aged} -o \"${var%.*}\" \"${var}\""
done
# Example usage: decryptLegacy file1.zip.age file2.zip.age
For when I do need to decrypt the files with legacy keys, the keys I no longer use with newly encrypted files. Hopefully I’ll not need to touch this script neither, it’s there just in case.
Conclusion
I believe GnuPG has served its purpose for it time when it’s was introduce, but in this day and age, it’s better to have a tool that is specialised for it own purpose and very good at it, for example:
- Age for file encryption
- Minisign for integrity checking or signing data!
- Signal for sending encrypted messages!
As for email, I wouldn’t bother I would use Signal instead! Email is generally not very secure even if you did use PGP and it doesn’t matter which email provider use, that include proton mail!
Just don’t send anything highly sensitive via email, as there is no end to end encryption at all, as the email needs to be stored on the servers!