» 2024 Mile42

Getting data securely to me, starting from (almost) nothing:

August 28, 2024 by TheCuriousCyclist Filed under Advice, Tech

If I’m out and about and my bike gets stolen, along with all of my gear – or worse yet, I get accosted by highwaymen who steal all my things by force and leave me stranded – my concern will be immediate physical safety.

Beyond that, and assuming there is at least some honest infrastructure I can use, my concern will be replacing my equipment. I have some important things memorized, but I also have a bandana I made with various secret information encoded on it.

So, assuming the criminals don’t strip the clothing off my head, I can contact friends and family, share identifying information, and authenticate with some online services. Another thing I can do with the bandana is exchange sensitive data over the internet by encrypting it, because it’s got a slightly obfuscated copy of my private RSA encryption key on it.

How does that work?

Let’s assume I’ve lost everything but the bandana, so I’m starting from scratch with some new blank laptop I bought in a local shop.

Using that I can connect to the internet and download various pre-encrypted things I’ve created, and access them with the key in the bandana. But I can also have people encrypt things and send them to me.

That’s why I made this post: The explanation below is the bare minimum people will need to safely send me things, large and small:

First thing you need is this public key:

Grab this text and paste it into a file called id_rsa.pub.pkcs8

To send:

Let’s say you have a big thing you want to send: secret.zip, a zipfile full of stuff.

We’re going to make a temporary key, encrypt that file with the key, encrypt the temporary key with my public RSA key, and package secret.zip and the encrypted temporary key together, like so:

$ openssl rand 64 | base64 -b 0 > key
$ openssl aes-256-cbc -in secret.zip -out secret.zip.enc -pass file:key
$ openssl rsautl -encrypt -oaep -pubin -inkey id_rsa.pub.pkcs8 -in key -out key.enc
$ tar -zcvf secret.tgz *.enc

The resulting file, secret.tgz, is what you’ll want to send me.

To receive:

When I get secret.tgz, I decompress it and find two files inside:

key.enc
secret.zip.enc

Then I run the following:

$ openssl rsautl -decrypt -oaep -inkey ~/.ssh/id_rsa -in key.enc -out key
$ openssl aes-256-cbc -d -in secret.zip.enc -out secret.zip -pass file:key

That gets me secret.zip, and the exchange is done.

It’s incredibly unlikely that I’ll ask anyone to send me things this way, but this page is here just in case.

A variation of this is how I intend to get all my data back in my hands even if I’m in a part of the world where everything I send or receive online is subject to eavesdropping or logging by weird state actors or random criminals.

References:

https://gist.github.com/fcoury/4890d7831d7e83ba1782 , https://www.bjornjohansen.com/encrypt-file-using-ssh-key