In a post last year, DIY Encrypted Password Vault, I showed a simple way to use OpenSSL to create encrypted text files. Since I’d need to de-crypt those files to edit them (usually with Vim) there would be an unencrypted temp file sitting around while I was editing. And using a filesystem with history meant they were around for a long time. BAD. Surely there is a better way…
Can we encrypt directly with Vim? Actually, yes…Vim has encryption built in (via the -x flag)…it works and it’s simple. Problem is that it uses ‘crypt’, which is not terribly hard to break. Also, it leaves a cleartext .tmp file around while you’re editing it. Which means it’s worthless to me for a password safe.
Enter the VIM openssl plugin. This plugin will allow you to write files with particular extensions corresponding to the type of encryption you desire (ex: ..des3 .aes .bf .bfa .idea .cast .rc2 .rc4 .rc5) and it turns off the swap file and .viminfo log, leaving no tmp files around. Excellent! Here’s typical usage:
Edit a new file with the .bfa extension:
$ vi test.bfa
Add your secrets and save it out. It will prompt you for a password (twice) to encrypt against.
blah blah blah : secrets of the world ~ ~ ~ ~ :wq enter bf-cbc encryption password: Verifying - enter bf-cbc encryption password:
You can look at the data in the file to see the encrypted content:
$ cat test.bfa U2FsdGVkX1+TPJBn3hsJ6nzsXzDvTXOxdDk1PkWkTDFG45HIvMnZbBNIrnJubPCY EexmfIJpZqo=
To re-open a previously encrypted file, just open it with vi. The plugin automatically recognizes the extension and prompts for your password:
"test.bfa" 2L, 78C enter bf-cbc decryption password:
Pretty slick! You’ll need the openssl binary in your path for this to work, which is pretty standard these days. Here is a little script that I run to set this up on my various home directories:
#! /bin/sh test -d ~/.vim || mkdir ~/.vim/ test -d ~/.vim/plugin || mkdir ~/.vim/plugin curl "http://www.vim.org/scripts/download_script.php?src_id=8564" > ~/.vim/plugin/openssl.vim
Edit: 2010+ versions of Vim have blowfish support. Excellent, forward progress! I'm probably not going to upgrade Vim on my Mac and all my servers just for this when a plugin can work. Good to see progress but for now, this makes the most sense for me.