envelope encryption

dec.sh

#!/bin/sh

set -e

if [ $# -ne 1 ]; then
    echo "usage: $0 <private_key>"
    exit 1
fi

KEYSIZE=256
KEY=$(umask 0177 && KEY=$(mktemp) && head -c $((2 * KEYSIZE)) | openssl rsautl -decrypt -inkey ${1} > ${KEY} && echo ${KEY})
function cleanup { rm -f ${KEY}; }
trap cleanup EXIT
openssl aes-256-cbc -d -salt -pass file:${KEY}

enc.sh

#!/bin/sh

set -e

if [ $# -ne 1 ]; then
    echo "usage: $0 <public_key>"
    exit 1
fi

KEYSIZE=256
KEY=$(umask 0177 && KEY=$(mktemp) && openssl rand ${KEYSIZE} > ${KEY} && echo ${KEY})
function cleanup { rm -f ${KEY}; }
trap cleanup EXIT
openssl rsautl -encrypt -inkey ${1} -pubin -in ${KEY}
openssl aes-256-cbc -salt -pass file:${KEY}