lisp/org-crypt.el

   1 ;;; org-crypt.el --- Public key encryption for org-mode entries
   2
   3 ;; Copyright (C) 2007, 2009, 2010  Free Software Foundation, Inc.
   4
   5 ;; Emacs Lisp Archive Entry
   6 ;; Filename: org-crypt.el
   7 ;; Version: 7.5
   8 ;; Keywords: org-mode
   9 ;; Author: John Wiegley <johnw@gnu.org>
  10 ;; Maintainer: Peter Jones <pjones@pmade.com>
  11 ;; Description: Adds public key encryption to org-mode buffers
  12 ;; URL: http://www.newartisans.com/software/emacs.html
  13 ;; Compatibility: Emacs22
  14
  15 ;; This file is part of GNU Emacs.
  16 ;;
  17 ;; GNU Emacs is free software: you can redistribute it and/or modify
  18 ;; it under the terms of the GNU General Public License as published by
  19 ;; the Free Software Foundation, either version 3 of the License, or
  20 ;; (at your option) any later version.
  21
  22 ;; GNU Emacs is distributed in the hope that it will be useful,
  23 ;; but WITHOUT ANY WARRANTY; without even the implied warranty of
  24 ;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  25 ;; GNU General Public License for more details.
  26
  27 ;; You should have received a copy of the GNU General Public License
  28 ;; along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.
  29
  30 ;;; Commentary:
  31
  32 ;; Right now this is just a set of functions to play with.  It depends
  33 ;; on the epg library.  Here's how you would use it:
  34 ;;
  35 ;; 1. To mark an entry for encryption, tag the heading with "crypt".
  36 ;;    You can change the tag to any complex tag matching string by
  37 ;;    setting the `org-crypt-tag-matcher' variable.
  38 ;;
  39 ;; 2. Set the encryption key to use in the `org-crypt-key' variable,
  40 ;;    or use `M-x org-set-property' to set the property CRYPTKEY to
  41 ;;    any address in your public keyring.  The text of the entry (but
  42 ;;    not its properties or headline) will be encrypted for this user.
  43 ;;    For them to read it, the corresponding secret key must be
  44 ;;    located in the secret key ring of the account where you try to
  45 ;;    decrypt it.  This makes it possible to leave secure notes that
  46 ;;    only the intended recipient can read in a shared-org-mode-files
  47 ;;    scenario.
  48 ;;    If the key is not set, org-crypt will default to symmetric encryption.
  49 ;;
  50 ;; 3. To later decrypt an entry, use `org-decrypt-entries' or
  51 ;;    `org-decrypt-entry'.  It might be useful to bind this to a key,
  52 ;;    like C-c C-/.  I hope that in the future, C-c C-r can be might
  53 ;;    overloaded to also decrypt an entry if it's encrypted, since
  54 ;;    that fits nicely with the meaning of "reveal".
  55 ;;
  56 ;; 4. To automatically encrypt all necessary entries when saving a
  57 ;;    file, call `org-crypt-use-before-save-magic' after loading
  58 ;;    org-crypt.el.
  59 ;;
  60 ;; TODO:
  61 ;;   - Allow symmetric encryption as well
  62
  63 ;;; Thanks:
  64
  65 ;; - Carsten Dominik
  66 ;; - Vitaly Ostanin
  67
  68 (require 'org)
  69
  70 ;;; Code:
  71
  72 (declare-function epg-decrypt-string "epg" (context cipher))
  73 (declare-function epg-list-keys "epg" (context &optional name mode))
  74 (declare-function epg-make-context "epg"
  75                   (&optional protocol armor textmode include-certs
  76                              cipher-algorithm digest-algorithm
  77                              compress-algorithm))
  78 (declare-function epg-encrypt-string "epg"
  79                   (context plain recipients &optional sign always-trust))
  80
  81 (defgroup org-crypt nil
  82   "Org Crypt"
  83   :tag "Org Crypt"
  84   :group 'org)
  85
  86 (defcustom org-crypt-tag-matcher "crypt"
  87   "The tag matcher used to find headings whose contents should be encrypted.
  88
  89 See the \"Match syntax\" section of the org manual for more details."
  90   :type 'string
  91   :group 'org-crypt)
  92
  93 (defcustom org-crypt-key ""
  94   "The default key to use when encrypting the contents of a heading.
  95
  96 This setting can also be overridden in the CRYPTKEY property."
  97   :type 'string
  98   :group 'org-crypt)
  99
 100 (defun org-crypt-key-for-heading ()
 101   "Return the encryption key for the current heading."
 102   (save-excursion
 103     (org-back-to-heading t)
 104     (or (org-entry-get nil "CRYPTKEY" 'selective)
 105         org-crypt-key
 106         (and (boundp 'epa-file-encrypt-to) epa-file-encrypt-to)
 107         (message "No crypt key set, using symmetric encryption."))))
 108
 109 (defun org-encrypt-string (str crypt-key)
 110   "Return STR encrypted with CRYPT-KEY."
 111   ;; Text and key have to be identical, otherwise we re-crypt.
 112   (if (and (string= crypt-key (get-text-property 0 'org-crypt-key str))
 113            (string= (sha1 str) (get-text-property 0 'org-crypt-checksum str)))
 114       (get-text-property 0 'org-crypt-text str)
 115     (let ((epg-context (epg-make-context nil t t)))
 116       (epg-encrypt-string epg-context str (epg-list-keys epg-context crypt-key)))))
 117
 118 (defun org-encrypt-entry ()
 119   "Encrypt the content of the current headline."
 120   (interactive)
 121   (require 'epg)
 122   (save-excursion
 123     (org-back-to-heading t)
 124     (let ((start-heading (point)))
 125       (forward-line)
 126       (when (not (looking-at "-----BEGIN PGP MESSAGE-----"))
 127         (let ((folded (outline-invisible-p))
 128               (epg-context (epg-make-context nil t t))
 129               (crypt-key (org-crypt-key-for-heading))
 130               (beg (point))
 131               end encrypted-text)
 132           (goto-char start-heading)
 133           (org-end-of-subtree t t)
 134           (org-back-over-empty-lines)
 135           (setq end (point)
 136                 encrypted-text
 137                 (org-encrypt-string (buffer-substring beg end) crypt-key))
 138           (delete-region beg end)
 139           (insert encrypted-text)
 140           (when folded
 141             (goto-char start-heading)
 142             (hide-subtree))
 143           nil)))))
 144
 145 (defun org-decrypt-entry ()
 146   "Decrypt the content of the current headline."
 147   (interactive)
 148   (require 'epg)
 149   (unless (org-before-first-heading-p)
 150     (save-excursion
 151       (org-back-to-heading t)
 152       (let ((heading-point (point))
 153             (heading-was-invisible-p
 154              (save-excursion
 155                (outline-end-of-heading)
 156                (outline-invisible-p))))
 157         (forward-line)
 158         (when (looking-at "-----BEGIN PGP MESSAGE-----")
 159           (let* ((end (save-excursion
 160                         (search-forward "-----END PGP MESSAGE-----")
 161                         (forward-line)
 162                         (point)))
 163                  (epg-context (epg-make-context nil t t))
 164                  (encrypted-text (buffer-substring-no-properties (point) end))
 165                  (decrypted-text
 166                   (decode-coding-string
 167                    (epg-decrypt-string
 168                     epg-context
 169                     encrypted-text)
 170                    'utf-8)))
 171             ;; Delete region starting just before point, because the
 172             ;; outline property starts at the \n of the heading.
 173             (delete-region (1- (point)) end)
 174             ;; Store a checksum of the decrypted and the encrypted
 175             ;; text value. This allow to reuse the same encrypted text
 176             ;; if the text does not change, and therefore avoid a
 177             ;; re-encryption process.
 178             (insert "\n" (propertize decrypted-text
 179                                      'org-crypt-checksum (sha1 decrypted-text)
 180                                      'org-crypt-key (org-crypt-key-for-heading)
 181                                      'org-crypt-text encrypted-text))
 182             (when heading-was-invisible-p
 183               (goto-char heading-point)
 184               (org-flag-subtree t))
 185             nil))))))
 186
 187 (defun org-encrypt-entries ()
 188   "Encrypt all top-level entries in the current buffer."
 189   (interactive)
 190   (org-scan-tags
 191    'org-encrypt-entry
 192    (cdr (org-make-tags-matcher org-crypt-tag-matcher))))
 193
 194 (defun org-decrypt-entries ()
 195   "Decrypt all entries in the current buffer."
 196   (interactive)
 197   (org-scan-tags
 198    'org-decrypt-entry
 199    (cdr (org-make-tags-matcher org-crypt-tag-matcher))))
 200
 201 (defun org-crypt-use-before-save-magic ()
 202   "Add a hook to automatically encrypt entries before a file is saved to disk."
 203   (add-hook
 204    'org-mode-hook
 205    (lambda () (add-hook 'before-save-hook 'org-encrypt-entries nil t))))
 206
 207 ;; FIXME Find a better way to encrypt Org auto-saved buffers?
 208 ;; When `auto-save-default' is non-nil, make sure entries are
 209 ;; encrypted before auto-saving
 210 ;; (when auto-save-default
 211 ;;    (add-hook
 212 ;;     'org-mode-hook
 213 ;;     (lambda () (add-hook 'auto-save-hook 'org-encrypt-entries nil t))))
 214
 215 (when auto-save-default
 216   (message "Warning: turn auto-save-mode off in Org buffers containing crypted entries.")
 217   (sit-for 5))
 218
 219 (add-hook 'org-reveal-start-hook 'org-decrypt-entry)
 220
 221 (provide 'org-crypt)
 222
 223 ;; arch-tag: 8202ed2c-221e-4001-9e4b-54674a7e846e
 224
 225 ;;; org-crypt.el ends here