emacs-circe/circe

Encrypting and decrypting key and cert files

createyourpersonalaccount opened this issue · 3 comments

createyourpersonalaccount commented

Hello,

I would like to add the feature of circe being able to use encrypted .pem files.

The circe-network-options variable has the option to give a function for :pass.

circe/circe.el

Lines 159 to 160 in 77e16de

:pass - The IRC server password to use for this network, or a
function to fetch it.

This function can decrypt a file to retrieve the password. It would be a useful feature to have for the key and cert in :tls-keylist as well. I have tried to locate where the circe-tls-keylist variable is used in the source code, but I could not understand who is responsible for reading the contents of the key and cert files.

Can someone please help me spot it? I started my search here:

circe/circe.el

Line 1287 in 77e16de

:tls-keylist circe-tls-keylist

wasamasa commented

See irc.el for this. The key list is passed on as is to gnutls-boot-parameters. While it would be possible to write a function that generates a list of unencrypted file names, I doubt it makes much sense to leave unencrypted files on the disk to accomodate that interface. Instead the time would be better spent enhancing Emacs' gnutls integration to support encrypted files.

wasamasa commented

I've looked into gnutls.c, apparently Emacs uses gnutls_certificate_set_x509_key_file instead of gnutls_certificate_set_x509_key_file2 (which is what the GnuTLS manual recommends). The latter supports a password argument for decrypting the key. This confirms my initial suspicion that this is best solved inside Emacs. If you happen to write/merge such a patch for Emacs or even convince the Emacs developers that this feature is important enough to bother with, feel free to let me know about it by submitting a link.

  • 👍1