SECRECY(1)

💖 SECRECY(1) 💖

the User's Manual page, but make it make sense ✨

okay so bestie, buckle up, because this is the manual for secrecy — the command line tool that ships with libsecrecy. it does encryption and key management and it is genuinely so useful once you get the vibe. let's go 🫶

---

🌸 NAME 🌸

secrecy — the libsecrecy encryption and key management tool 💅

---

✨ SYNOPSIS ✨

secrecy createKey cipher gpgid keyname

secrecy encrypt [keyhash|keyname]

secrecy decrypt

secrecy exportKey [keyhash|keyname] gpgid

secrecy importKey gpgid

secrecy listKeys

secrecy setDefaultKey keyname

---

🎀 DESCRIPTION 🎀

so the libsecrecy distribution comes with this command line tool called secrecy, right? and rn it's got seven subcommands: createKey, encrypt, decrypt, exportKey, importKey, listKeys and setDefaultKey. seven. a whole little squad 💖

secrecy accepts several subcommands. but here's the thing you need to know: currently, secrecy has no arguments for reading and writing any file. none. zero. not a single one. 😭 you have to rely on the shell's capabilities to read and write plain files, encrypted files, and key exports — using pipes and redirection operators. that's the whole move. that's the assignment. the shell does the plumbing, secrecy does the crypto. periodt.

Subcommands are the following:

👑 secrecy createKey cipher gpgid keyname

creates keys for libsecrecy. here's the breakdown:

• cipher can currently take the values AES128, AES192 or AES256 🔥
• gpgid needs to be a valid id (normally an email address) that's present as a secret key in gpg(1)'s keyring. this is what gets used for securely storing the AES key for use by libsecrecy
• keyname — you get to pick a human readable name for the key you just created, for instance "mykey"
• the program outputs a key hash in the form of a hexadecimal encoded string
• either this key hash or the key name you gave can be provided to the encrypt command of secrecy for encrypting files using the newly created key

🌟 secrecy encrypt [keyhash|keyname]

this subcommand allows one to encrypt files. keyhash/keyname is either the hexadecimal string which was printed by createKey when creating the key, or the name given to createKey when creating the key. if the string provided is empty, then the default key name is used if any has been set; see setDefaultKey.

⚠️ note that this command needs to decrypt the key from its gpg(1) encoded form, so you will need to provide the respective passphrase in some form. no passphrase, no encryption, no cap 🙈

🧚 secrecy decrypt

this subcommand allows one to decrypt files. it needs to decrypt the key from its gpg(1) encoded form, so you will need to provide the respective passphrase in some form.

💡 the good news? you do not need to provide the keyhash for decryption, because that information is provided inside the encrypted file. the file literally tells you which key it wants. main character energy tbh 💅

🦋 secrecy exportKey [keyname|keyhash] gpgid

export to an encrypted transfer format, for passing data on to third parties, via the exportKey command of secrecy. keyname or keyhash are a valid key name or hash respectively, and gpgid is a string identifying the recipient of the key. the public key of gpgid needs to be available in gpg's key database.

🍓 secrecy importKey gpgid

import a key from the format produced by the exportKey command, using the importKey command, where gpgid designates the gpg key which will be used to locally encrypt the key for storing it in libsecrecy's database.

🌈 secrecy listKeys

list installed keys. it prints a tabulation separated table such that the first column contains the key names and the second the respective key hash values. yes, it's a table. yes, it's giving organized. we love a tidy girlie ✨

💜 secrecy setDefaultKey keyname

change the default key. the default key is used when an empty keyname is used for running any command accepting a key name, with the obvious exceptions of createKey and setDefaultKey. those two are the exceptions, so don't come for me 💅

---

📁 FILES 📁

AES keys are stored encrypted using gpg(1) via gpgme. each key is assigned a hash H value at creation time. H is computed as the SHA256 checksum of a randomly generated sequence. 🔐

keys are stored and searched for in the directory set in the environment variable LIBSECRECY_KEYDIR.

if this variable is not set, then the subdirectory .libsecrecy inside the current user's home directory — designated by the environment variable HOME — is used.

inside this directory the key for hash H is stored in the file hash/H, otherwise said:

hash/3E35C013C66C66B09E3E0B923451530C62D4346D9F5165906FC94B9B4D35E28E

where the respective files are encrypted using gpgme. the secret key used for this encryption can be set at key creation time. 🎀

---

🌈 EXAMPLES 🌈

create an AES256 key using your GPG ID, for instance foo@example.org, and call it mykey:

$ secrecy createKey AES256 foo@example.org mykey
3E35C013C66C66B09E3E0B923451530C62D4346D9F5165906FC94B9B4D35E28E

list available keys:

$ secrecy listKeys
mykey     3E35C013C66C66B09E3E0B923451530C62D4346D9F5165906FC94B9B4D35E28E

set mykey as default key:

$ secrecy setDefaultKey mykey

encrypt file into file.encrypted, using the default key:

$ secrecy encrypt < file > file.encrypted

decrypt file.encrypted into file.decrypted, using the default key:

$ secrecy decrypt < file.encrypted > file.decrypted

prepare an export of mykey for use by the person behind GPG ID bar@example.org, whose public key should be accessible in the user's gpg(1) keyring. the key will be exported into the file export.key:

$ secrecy exportKey mykey bar@example.org > export.key

see? pipes and redirection. the shell really said "I got you bestie" 🫶

---

👑 AUTHORS 👑

secrecy is a program part of the libsecrecy, written by German Tischler-Höhle <germant@miltenyibiotec.de>.

the present manual page is written by Étienne Mollier <emollier@debian.org> for the Debian project. 💖

---

🦋 SEE ALSO 🦋

see the GnuPG documentation relative to key management for creating and handling gpg(1) keys.

---

okay that's the whole page bestie, you're officially certified 💅 this one's from the GNU crew, version dated 2020-11-13, and it lives at SECRECY(1). go encrypt something iconic. mwah 😘✨