diff --git a/tools/secretstore.py b/tools/secretstore.py
index 6b88d28..c6a171b 100644
--- a/tools/secretstore.py
+++ b/tools/secretstore.py
@@ -10,6 +10,18 @@
     "482FF104C29294AD1CAF827BA43890A3DE74ECC7", # inf
 ]
 
+def encrypt(src, dst):
+    cmd = ['gpg' , '--encrypt', '--armor', '--batch', '--yes', '--output', dst]
+    for k in keys:
+        cmd.append('--recipient')
+        cmd.append(k)
+    cmd.append(src)
+    subprocess.check_call(cmd)
+
+def decrypt(src, dst):
+    cmd = ['gpg', '--decrypt', '--output', dst, src]
+    subprocess.check_call(cmd)
+
 def main():
     if len(sys.argv) < 3 or sys.argv[1] not in ('encrypt', 'decrypt'):
         sys.stderr.write("Usage: {} encrypt/decrypt file\n".format(sys.argv[0]))
@@ -20,15 +32,9 @@
     src = sys.argv[2]
 
     if action == 'encrypt':
-        cmd = ['gpg' , '--encrypt', '--armor', '--batch', '--yes', '--output', '-']
-        for k in keys:
-            cmd.append('--recipient')
-            cmd.append(k)
-        cmd.append(src)
-        subprocess.check_call(cmd)
+        encrypt(src, '-')
     else:
-        cmd = ['gpg', '--decrypt', '--output', '-', src]
-        subprocess.check_call(cmd)
+        decrypt(src, '-')
 
 if __name__ == '__main__':
     sys.exit(main() or 0)