1 #+TITLE: Encrypting org Files.
3 #+EMAIL: ian at manor-farm dot org
4 #+OPTIONS: H:3 num:nil toc:t \n:nil ::t |:t ^:t -:t f:t *:t tex:t d:(HIDE) tags:not-in-toc
5 #+STARTUP: align fold nodlcheck hidestars oddeven lognotestate
6 #+SEQ_TODO: TODO(t) INPROGRESS(i) WAITING(w@) | DONE(d) CANCELED(c@)
7 #+TAGS: Write(w) Update(u) Fix(f) Check(c)
12 # This file is released by its authors and contributors under the GNU
13 # Free Documentation license v1.3 or later, code examples are released
14 # under the GNU General Public License v3 or later.
16 [[file:../index.org][{Back to Worg's index}]]
18 * General Information About Encrypting Files with Emacs.
19 Emacs uses EasyPG as an interface to gnupg. If you have a recent
20 version of Emacs (at least 23) EasyPG is part of Emacs. However,
21 several package managers include a version of EasyPG for use with
22 earlier versions of Emacs. If your version of Emacs comes with EasyPG,
23 don't install the EasyPG package, as this will lead to conflicts.
25 To set up Emacs for transparent encryption and decryption you need to
26 add the following to your .emacs:
28 #+BEGIN_SRC emacs-lisp
33 * Encrypting the Whole File Using EasyPG.
34 If you want to encrypt the whole file using gnupg, but still have the
35 decrypted file recognized as an org file, you should make:
38 # -*- mode:org; epa-file-encrypt-to: ("me@mydomain.com") -*-
41 the first line in the file. Where =me@mydomain.com= is the email
42 address associated with your default gnupg key. Note that gpg
43 encrypted files should be saved with the default extension of =.gpg=.
45 When you open the file you will be prompted for your password and
46 Emacs will display the decrypted contents in org-mode. When you save
47 the file it would automatically be encrypted.
49 * Symmetric or Public Key Encryption.
50 If you use symmetric encryption all that is required to
51 encrypt/decrypt your file is the pass phrase. Using Public Key
52 Encryption, you require both your private key and your pass phrase.
54 EasyPG can use both methods of encryption. If you want to use
55 symmetric encryption omitting the "epa-file-encrypt-to: " from your
56 =.gpg= file or setting it to ~nil~ should do the trick. If this doesn't
57 work, you may try setting the variable:
59 #+BEGIN_SRC emacs-lisp
60 (setq epa-file-select-keys nil)
63 Conversely, if you want to use Public Key Encryption make sure that
64 you specify "epa-file-encrypt-to: " at the beginning of your file.
66 * Encrypting Specific Entries in an org File with org-crypt.
67 If you just want to encrypt the text of an entry, but not the
68 headline, or properties you can use org-crypt. In order to use
69 org-crypt you need to add something like the following to your .emacs:
71 #+BEGIN_SRC emacs-lisp
73 (org-crypt-use-before-save-magic)
74 (setq org-tags-exclude-from-inheritance (quote ("crypt")))
75 ;; GPG key to use for encryption
76 ;; Either the Key ID or set to nil to use symmetric encryption.
77 (setq org-crypt-key nil)
80 Now any text below a headline that has a =:crypt:= tag will be
81 automatically be encrypted when the file is saved. If you want to use
82 a different tag just customize the =org-crypt-tag-matcher= setting.
84 Preventing tag inheritance stops you having encrypted text inside
87 To decrypt the text just call =M-x org-decrypt-entry= and the
88 encrypted text where the point is will be replaced with the plain
89 text. If you use this feature a lot, you will probably want to bind
90 =M-x org-decrypt-entry= to a key.
92 Entries with a =:crypt:= tag will be automatically be encrypted when you
95 ** Emacs Backup Files - a Warning.
96 With org-crypt, if you have autosave turned on and decrypt the
97 entries, the autosave file will contain the entries in plain text. For
98 this reason your should disable autosave for encrypted files.
100 * Using gnupg-agent to Cache Your Passwords.
101 If you need to decrypt files frequently, you will probably get fed up
102 of typing in your password each time you open an encrypted file. You
103 can use gpg-agent to cache your passwords, so you only need to type
104 your password once. Obviously this has security implications and it's
105 up to you to decide whether you want your passwords cached.
107 On Debian based systems your can install gpg-agent using your
111 sudo apt-get install gpg-agent
114 You can configure gnupg-agent by editing =~/.gnupg/gpg-agent.conf=. As a
115 minimum you will probably want to set:
117 - =default-cache-ttl= the time the cahse entry is valid in seconds. The
119 - =max-cache-ttl= the maximum time a cache entry is valid in
120 seconds. After this time the cache entry will be expired even if it
121 has been accessed recently.
124 To ensure that gnupg uses gnupg-agent you should edit
125 =~/.gnupg/gpg.conf= and make sure that the use-agent line is
128 If you are using a console based system you need to:
134 in your shell's startup script.
136 If you are using a window manager you will probably want to install
137 one of the pin entry programs, such as pinentry-gtk2 or pinentry-qt,
138 so that X can prompt you for your pass phrase.
141 Now when you try to open a =.gpg= file, or decrypt some text encrypted
142 with org-crypt, you will be prompted for your pass phrase, but your
143 password will be cached so re-opening the file, or decrypting another
144 region will not prompt you for your password again.