33

Is there an encrypting text editor for ubuntu? In other words, the text editor, preferably GUI capable, should always save an encrypted file and always prompt for the password to re-open the file. The point is to combine the functionality of a text editor with an encryption tool.

4
  • 10
    A word of warning: text editors, or sometimes even operating systems, will store data on disk out side of the normal save/open operations. Vim for example will store data in in files ending in ~ or .swp as backups and Linux will swap out memory to disk if it runs short of RAM. Because of this, simply encrypting a text file will not keep your data safe from a determined attacker with physical access to your machine. If your data is really important, use full disk encryption. FDE is pretty easy to do in Ubunutu, see eff.org/deeplinks/2012/11/…. Mar 20, 2014 at 19:09
  • 1
    For an emacs solution, also see: emacswiki.org/emacs/AutoEncryption Mar 21, 2014 at 0:51
  • Via @stormvirux is this article that describes how to eliminate the risk posed by swap and backup files created by vim. techrepublic.com/blog/it-security/…
    – H2ONaCl
    Mar 21, 2014 at 8:34
  • @TwentyMiles FDE discussion is made more complete by describing the costs. Here is a link to something that describes the loss of throughput and another link to the financial cost. searchmidmarketsecurity.techtarget.com/tip/… Link: networkcomputing.com/careers-and-certifications/…
    – H2ONaCl
    Apr 4, 2019 at 18:12

9 Answers 9

22

Vi/Vim

Just use vim or vi which offers file encryption with blowfish when using -x option.

create a file for encryption as follows:

vim -x filename.txt

Then it will prompt to enter encryption key

Enter encryption key:

Once a file has been encrypted by Vim once, you never need to use the -x option when opening that file again. Vim will automatically recognize it as an encrypted file and do the right thing.

Because Blowfish is a symmetric key encryption system, the same key is used for both encryption and decryption. When Vim opens a file for the first time with the -x option, the first thing it will do is ask you to give it a key you can use to encrypt and decrypt the file, with this prompt:

Need encryption key for "abc.txt"
Enter encryption key:

After entering the key, you will then be asked to confirm the key, to ensure you did not mistype it.

Enter same key again:

Then it will open as normally as usual.

Read more here

CryptoTE

According to the website.

CryptoTE is a text editor with integrated strong cryptography. 
It is based on the popular Scintilla widget and automatically stores 
text data in secure encrypted container files. 
Compared to other "password keeper" programs, CryptoTE does not force 
any structure upon your data: it works with plain ASCII text 
and does not require you to fill in grids, key-value attributes,descriptions etc. 
Encryption is transparently performed using the 
highly-secure Serpent cipher. The editing interface is thoroughly 
optimized for speed and ease of use. 
Multiple subfiles, Quick-Find and a two-click random password generator 
make daily use very convenient.

enter image description here

for ubuntu see.

7
  • 1
    It was looking like an attractive solution until I read at your link that the default behaviour is to leave unencrypted data on the disk. The user would have to remember to set nobackup, noswapfile, and nowritebackup in a configuration file on every clean system. If you use Ubuntu LTS versions, that means you need to remember to do that every 5 years, or more frequently. I suppose it's more likely to be remembered if this is performed at a high frequency.
    – H2ONaCl
    Mar 20, 2014 at 13:33
  • @broiyan then cryptoTE might fit what you want plus it has a gui
    – Stormvirux
    Mar 20, 2014 at 13:40
  • I like that CryptoTE uses a symmetric password and that the text file is free-format; notwithstanding the example screenshot. The container concept is useful for providing a simple means of organization.
    – H2ONaCl
    Mar 21, 2014 at 8:35
  • 2
    Cryptographers would comment that Blowfish isn't considered secure enough.
    – freddyb
    Mar 21, 2014 at 13:41
  • 1
    Blowfish is practically secure for files < 500G in size!, see news.softpedia.com/news/… => Researchers say that after sending constant server requests for between 30 and 38 hours, and collecting around 785 GB of traffic, they'll be able to spot a collision attack
    – mosh
    Dec 5, 2019 at 0:33
17

Gedit.

REQUIREMENTS

  • Gedit
  • Gedit plugin – External tools (enabled)
  • A valid gpg key

ENABLE GnuPG
This will only work if you have enabled GnuPG in your system.

GnuPG is an implementation of PGP (Pretty Good Privacy), which is a form of public key/private key encryption.

Install GnuPG

sudo apt-get install gnupg

Generate your keys:

gpg --gen-key 

When generating the keys, you can just press enter at any time to accept the default value in brackets. The most important part of your key generation is choosing your passphrase.

Your public keyring should just contain your own public key for now, you can view the keyring with the --list-keys option and your private key with the --list-secret-keys option.

gpg --list-keys
gpg --list-secret-keys

GnuPG source: http://www.ianatkinson.net/computing/gnupg.htm


SETUP

Just go to Tools > Manage External Tools, and add the scripts:

ENCRYPT
Paste the following code on a new command, called “Encrypt”:

#!/bin/bash
stdin=$(cat)

if [ ! "${stdin:0:27}" == "-----BEGIN PGP MESSAGE-----"  ]; then 
    echo "$stdin" | gpg -a -e -r [email protected] --no-tty -
else
    echo "$stdin"
fi

with the options:

  • ShortCut - Control + Shift + E
  • Save - Nothing
  • Input - Current document
  • Output - Replace current document
  • Applicability - All documents / All languages

enter image description here

DECRYPT
Paste the following code on a new command, called “Decrypt”:

#!/bin/bash
stdin=$(cat)
 
if [ "${stdin:0:27}" == "-----BEGIN PGP MESSAGE-----"  ]; then 
    echo "$stdin" | gpg -d --no-tty - 2> /dev/null
else
    echo "$stdin"
fi

with the options:

  • ShortCut - Control + Shift + D
  • Save - Nothing
  • Input - Current document
  • Output - Replace current document
  • Applicability - All documents / All languages

enter image description here


USAGE

Once that is done, then you can open encrypted files (asc – ascii files, not binary), or create new ones on spot using the shortcuts.

Example:

enter image description here

enter image description here

SOURCE
http://blog.brunobraga.net/encrypting-and-decrypting-with-gedit/


METHOD 2 Another way is to install zillo.

A simple plugin for gedit 3 that encode and decode selected text to base64.

See this question on how to install the plugin

7
  • Instead of if [ ! ... == you should use if [ ... != .
    – Kevin
    Mar 20, 2014 at 15:06
  • @Kevin Where should I make the change?
    – Parto
    Mar 20, 2014 at 15:17
  • Your encrypt script
    – Kevin
    Mar 20, 2014 at 15:18
  • @Kevin But it's working fine as is. I have tested it in my Gedit...
    – Parto
    Mar 20, 2014 at 16:11
  • 1
    Yes, it works as-is, but != is much cleaner than ! ... ==.
    – Kevin
    Mar 20, 2014 at 16:22
10

Naturally, you can also do this in emacs. The emacs wiki has a very nice page on this, providing 7 different approaches:

The simplest would probably be EasyPG Assistant since it is an interface to GnuPG and should work out of the box.

2
  • 1
    EasyPG is bundled with Emacs. To encrypt a file just save it with .gpg extension.
    – jfs
    Mar 26, 2014 at 7:29
  • 1
    Heh. There should be a list of what cannot be done in emacs... ;)
    – n611x007
    Aug 25, 2015 at 10:35
8

You could try vim with the gnupg.vim plugin, which is for transparent editing of gpg encrypted files.

gnupg.vim description:

This script implements transparent editing of gpg encrypted files. The filename must have a ".gpg", ".pgp" or ".asc" suffix. When opening such a file the content is decrypted, when opening a new file the script will ask for the recipients of the encrypted file. The file content will be encrypted to all recipients before it is written. The script turns off viminfo and swapfile to increase security.

7

If you like Geany, there's a plugin (sudo apt-get install geany-plugin-pg):

GeanyPG is a plugin for Geany that allows the user to encrypt, decrypt and verify signatures with GnuPG.

Also: http://plugins.geany.org/geanypg.html

2

EncryptPad - an application for viewing and editing symmetrically encrypted text. It also provides a tool for encrypting and decrypting binary files on disk. It is compatible with OpenPGP. So you can open files encrypted with OpenPGP software. There is also key file protection and a password generator. Platforms: Linux, Mac OS X and Windows.

Main Window in Windows

enter image description here

Binary Encryptor Dialogue in Lubuntu

enter image description here

1

DeadboltEdit - A secure encrypting text editor for Linux, Mac OS X, and Windows.

It uses Blowfish encryption, compatible with the OpenSSL implementation.

Website: www.deadboltedit.org

0

You can do it all in the command line interface with nano editor and gpg as encryption. But I don't know how secure this is. Maybe someone else can comment on that

create a text file called text_file

encrypt it with: gpg -c text_file

this will ask you to set a passphrase

now you have the encrypted text_file.gpg and the unencrypted text_file

you can delete the unencrypted text_file

I wrote a bash script to make the process of updating the text_file.gpg easier. This will:

  decrypt the text_file.gpg
  open the text_file in nano editor

after you edited the file it will:

  delete the old text_file.gpg
  create a new text_file.gpg
  delete the new text_file if a new text_file.gpg was successfully created.

#!/bin/bash -e
gpg text_file.gpg
nano text_file
shred --remove text_file.gpg
gpg -c text_file
if [ -f text_file.gpg ] ; then
    shred --remove text_file
else
    echo "new gpg file not found, keeping the text file"
fi

Save the bash script as an .sh file for example script_file.sh.

Whenever you want to edit the text_file.gpg, you can call the script_file.sh with:

sh script_file.sh
0

For me, the easiest was gnu emacs. https://www.gnu.org/software/emacs/ Especially since I already had it installed and I was gleefully surprised that it 'just worked'

emacs file.gpg

(gui prompt for passphrase)

file opens.

and Ctrl-x-s (which is how you save in emacs) will prompt you for a new passphrase.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .