$darkmode
Elektra 0.11.0
Plugin: gpgme

The gpgme plugin is a filter plugin that enables users to encrypt values before they are persisted and to decrypt values after they have been read from a backend. The encryption and decryption is designed to work transparently.

The cryptographic operations are performed by GnuPG via the libgpgme library.

Installation

See installation. The package is called libelektra5-experimental.

Dependencies

Build Information

The plugin has been tested on Ubuntu 18.04 with libgpgme version 1.10.

Examples

You can mount the plugin like this:

1 kdb mount test.ecf /t gpgme "encrypt/key=DDEBEF9EE2DC931701338212DAF635B17F230E8D"

Now you can specify a key user:/t/a and protect its content by using:

1 kdb set user:/t/a
2 kdb meta-set user:/t/a crypt/encrypt 1
3 kdb set user:/t/a "secret"

The value of user:/t/a (for this example: "secret") will be stored encrypted. You can still access the original value by using kdb get:

1 kdb get user:/t/a

Configuration

GnuPG Keys

The GPG recipient keys can be specified in two ways:

  1. The GPG recipient key can be specified as encrypt/key directly.
  2. If you want to specify multiple keys, you can enumerate them under encrypt/key.

The following example illustrates how multiple GPG recipient keys can be specified:

1 encrypt/key/#0
2 encrypt/key/#1

Textmode

gpgme operates in textmode per default. In textmode the output of GPG is ASCII armored.

Textmode can be disabled by setting /gpgme/textmode to 0 in the plugin configuration.

Technical Details

Message Format

The encrypted values are valid PGP messages, that can be decrypted and read solely by the GnuPG binary without Elektra.