How to encrypt your secrets with the scrypt utility on Ubuntu, print them on paper and then read them again

Your secrets are in the file secret.txt.

Install the scrypt utility:

$ sudo apt-get install scrypt

Encrypt the file with custom scrypt parameters (about 1G of RAM, 200 seconds; in reality it takes less than 200 seconds on my system, see this Github bug report): 

$ scrypt enc -M 1073741824 -t 200 secret.txt encrypted.scrypt

Now, you got your encrypted data in the file encrypted.scrypt. You can upload it to your favorite cloud storage provider (Google Drive, DropBox, email it to your Gmail, Proton Mail and Yahoo Mail addresses, etc.).

If you want it on paper type into the command line:

$ base64 encrypted.scrypt > encrypted.scrypt.base64.txt

You can open the encrypted.scrypt.base64.txt file with your favorite editor (LibreOffice Writer) and set a proper font before printing it (this is critical - when printing your keys make sure you use a proper font (that don't have similar characters - like "I" and "l", zero and big O)).

To decrypt the encrypted data:

$ scrypt dec encrypted.scrypt decrypted.secret.txt

If you want to restore your printed data, first you need to OCR the page, correct errors (if any) and to decode from base64 encoding:

$ base64 -d text.from.OCR.app.txt >  encrypted.scrypt

Instead of just a plain text file you can store your secrets into a KeePass container. But KeePass2 is known to have a inefficient key stretching algorithm. And on KeePassX you can't change the key stretching settings. So, it's wise to encrypt your KeePass container with scrypt (using another password!).

Please be aware that writing directly on your unencrypted hard drive is dangerous. Deleted data can be theoretically restored. Also, if you use unencrypted swap your secrets are probably written on your hard drive unencrypted. It's better to write on a tmpfs. Or just use Live Linux distribution like Tails. Read more here: Archiving private keys - TLDR version.

Comments

Post a Comment

Popular posts from this blog

[fixed] "Evolution is currently offline due to a network outage."

Evolution is currently offline due to a network outage. Evolution will return to online mode once a network connection is established. If you have this error when updating your system (for example, from Ubuntu 14 to Ubuntu 16), the solution is to run Evolution with this command: evolution --force-online That is usually related to a combination of evolution, dbus, and NetworkManager. With all three installed the idea was that NM would say whether it had a working network or not over dbus. Tools like evolution would ask on dbus about the state of the network and switch to online or offline as networks were hotplugged. This breaks down when the network isn't managed by NM but NM is still running. Such as when /etc/network/interfaces is configured to use ifupdown instead. If NM is running then it won't have any networks under its control and it fails to recognize that the system does actually have a network running outside of its control. It will respond to evolution
Read more

Do not use (only) flash memory (SSD drives, hardware wallets, USB flash drives) for your precious private keys!

Image
Flash memory is not a reliable medium for archives. Especially when there is no regular power. I have personal experience with usb flash drive not powered for weeks - one file became corrupted . (Read more here: Archiving private keys - TLDR version. ) You should always back up on paper and other mediums. Flash memory is prone to failure if it is not powered for weeks or more and if there are ionizing radiation When you write your precious private keys you should use technologies like Parchive and ZFS . And make several copies of your files. It's OK if you use your USB flash drive for another backup, but don't rely on it! Always back up on DVDs (even small files!), paper and online (after encryption with CPU and RAM intensive key derivative function like scrypt). Here is example of using the scrypt utility: $ sudo apt-get install scrypt $ scrypt enc -M 1073741824 -t 200 secret.txt encrypted.scrypt Do not use default values of "-M" and "-t", they
Read more

Archiving private keys - TLDR version

0. Make multiple encrypted copies. On DVDs (they are better than CDs and Blu-Ray discs; DVD+R are better than DVD-R), paper, cloud services like DropBox, OneDrive, Google Drive, e-mail it to yourself and to your friends, use P2P storage services like MaidSafe, Storj and Sia , etc. 1. Use proper font when printing PGP encrypted keys on paper. 2. Flash memory (SSD, USB flash drives, hardware wallets) is less reliable when not powered regularly (i.e. every week). 3. Use error correction methods like Parchive and ZFS. 4. Print on paper or store on digital media only encrypted data. 5. Your encryption software should use CPU/RAM-intensive KDF (i.e. scrypt with secure options - do not use defaults! ). First, encrypt with scrypt and then encrypt it again with PGP (using different password!) in ASCII armor mode before print it (other methods like QR codes may not be reliable as multiple copies of the PGP ASCII armor). Do not use the same password for the PGP because it's easy to brute
Read more
[ad removed]