{"action":"created","issue":{"url":"https://api.github.com/repos/ncw/rclone/issues/922","repository_url":"https://api.github.com/repos/ncw/rclone","labels_url":"https://api.github.com/repos/ncw/rclone/issues/922/labels{/name}","comments_url":"https://api.github.com/repos/ncw/rclone/issues/922/comments","events_url":"https://api.github.com/repos/ncw/rclone/issues/922/events","html_url":"https://github.com/ncw/rclone/issues/922","id":192888350,"number":922,"title":"[Feature Request]: Transparent de(en)cryption of mounted directory using gpg","user":{"login":"rowhit","id":4926941,"avatar_url":"https://avatars.githubusercontent.com/u/4926941?v=3","gravatar_id":"","url":"https://api.github.com/users/rowhit","html_url":"https://github.com/rowhit","followers_url":"https://api.github.com/users/rowhit/followers","following_url":"https://api.github.com/users/rowhit/following{/other_user}","gists_url":"https://api.github.com/users/rowhit/gists{/gist_id}","starred_url":"https://api.github.com/users/rowhit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rowhit/subscriptions","organizations_url":"https://api.github.com/users/rowhit/orgs","repos_url":"https://api.github.com/users/rowhit/repos","events_url":"https://api.github.com/users/rowhit/events{/privacy}","received_events_url":"https://api.github.com/users/rowhit/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-12-01T16:06:32Z","updated_at":"2017-02-22T21:11:49Z","closed_at":null,"body":"Hi,\r\n\r\nI am new to rclone. I really liked the project. It almost has all the feature I need for cloud backup. However, it would be great if the above mentioned feature is implemented.\r\n\r\nAssuming following directories\r\n- /path/to/encrypted/dir\r\n-/path/to/decrypted/dir\r\nimplement something similar to the following:\r\nrclone mount --decrypt-gpg \"gpg-key-fingerprint\" /path/to/encrypted/dir /path/to/decrypted/dir\r\nrclone umount /path/to/decrypted/dir\r\n\r\nNow, the sync process can continue in the background for encrypted dir and user can continue working . I am not sure, if the backup can corrupted if work is being done simultaneously on decrypted dir."},"comment":{"url":"https://api.github.com/repos/ncw/rclone/issues/comments/281805403","html_url":"https://github.com/ncw/rclone/issues/922#issuecomment-281805403","issue_url":"https://api.github.com/repos/ncw/rclone/issues/922","id":281805403,"user":{"login":"davidstrauss","id":113350,"avatar_url":"https://avatars.githubusercontent.com/u/113350?v=3","gravatar_id":"","url":"https://api.github.com/users/davidstrauss","html_url":"https://github.com/davidstrauss","followers_url":"https://api.github.com/users/davidstrauss/followers","following_url":"https://api.github.com/users/davidstrauss/following{/other_user}","gists_url":"https://api.github.com/users/davidstrauss/gists{/gist_id}","starred_url":"https://api.github.com/users/davidstrauss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidstrauss/subscriptions","organizations_url":"https://api.github.com/users/davidstrauss/orgs","repos_url":"https://api.github.com/users/davidstrauss/repos","events_url":"https://api.github.com/users/davidstrauss/events{/privacy}","received_events_url":"https://api.github.com/users/davidstrauss/received_events","type":"User","site_admin":false},"created_at":"2017-02-22T21:11:49Z","updated_at":"2017-02-22T21:11:49Z","body":"I should be more clear with my recommendations. Here's how it would work for writing and reading. All of the file names are, of course, suggestions.\r\n\r\nWriting a file (including a new revision of an existing file):\r\n\r\n1. Generate a new symmetric key.\r\n2. Encrypt the file using the key. AES-256 is quite good for this, and it's hardware-accelerated on many machines. Store this file as something like `FILENAME.ext.aes`.\r\n3. Load the list of authorized public keys from `.gpg-id`.\r\n3. Encrypt the symmetric key using GPG to the authorized public keys. (The private key is not necessary here.) Store this in something like `FILENAME.ext.key.gpg`.\r\n4. Upload both files.\r\n\r\nReading a file:\r\n\r\n1. Download both the `.aes` and `.key.gpg` files.\r\n2. Decrypt the symmetric key from the `.key.gpg` file using GPG. This decryption may actually occur on a smart card, but the GPG agent abstracts all of that.\r\n3. Use the symmetric key to decrypt the file.\r\n\r\nAdding a new authorized GPG key:\r\n\r\n1. Update `.gpg-id` to add the new key ID.\r\n2. Using an existing GPG key, decrypt each `.key.gpg` file and re-encrypt to include all authorized keys.\r\n3. Upload the altered (and small) `.key.gpg` files.\r\n\r\nRevoking an authorized GPG key:\r\n\r\n1. Update `.gpg-id` to add the remove the key ID. All future files and revisions will now be unreadable by the revoked authorization.\r\n2. Optional: Re-encrypt existing files as if creating a new revision, removing the ability of the revoked key to read the current data."}}
{"actor":{"display_login":"davidstrauss"}}