0

I am trying to import a PGP key into NixOS (exported from Openkeychain). This key is used to encrypt and decrypt a list of passwords (with pass).

The following are the steps to reproduce the issue (you may follow this guide):

  1. In Openkeychain, do a backup of the key, write down the 36-digit code and save it;

  2. In NixOS (let's say you have the backup key in your ~/Downloads folder), type the following:

nix-shell -p gnupg --run 'gpg --decrypt --pinentry-mode=loopback ~/Downloads/backup_2021-09-16.sec.pgp | gpg --import' 

This should result in a secret key imported but I only get a public key. Here is the full output:

gpg: unknown armor header: Passphrase-Format: numeric9x4
gpg: unknown armor header: Passphrase-Begin: 40
gpg: AES256.CFB encrypted data
gpg: encrypted with 1 passphrase
gpg: key 0x10D48E16F953D026: public key "John Doe <john@doe.com>" imported
gpg: key 0x10D48E16F953D026: "John Doe <john@doe.com>" not changed
gpg: key 0x10D48E16F953D026/0x10D48E16F953D026: error sending to agent: Without pinentry
gpg: error building skey array: Sem pinentry
gpg: error reading '[stdin]': Without pinentry
gpg: import from '[stdin]' failed: Without pinentry
gpg: Total number processed: 1
gpg:               imported: 1
gpg:              unchanged: 1
gpg:       secret keys read: 1

I tried adding the following entry to gpg-agent.conf, as suggested here:

pinentry-program /run/current-system/sw/bin/pinentry-curses

Then $ gpgconf --reload gpg-agent to reload the gpg-agent followed by the import command:

nix-shell -p gnupg --run 'gpg --decrypt --pinentry-mode=loopback ~/Downloads/backup_2021-09-16.sec.pgp | gpg --import'

Will output this:

gpg: unknown armor header: Passphrase-Format: numeric9x4
gpg: unknown armor header: Passphrase-Begin: 40
gpg: AES256.CFB encrypted data
gpg: encrypted with 1 passphrase
gpg: key 0x10D48E16F953D026: public key "John Doe <john@doe.com>" imported
gpg: key 0x10D48E16F953D026: "John Doe <john@doe.com>" not changed
gpg: key 0x10D48E16F953D026/0x10D48E16F953D026: error sending to agent: Inappropriate ioctl for device
gpg: error building skey array: Inappropriate ioctl for device
gpg: error reading '[stdin]': Inappropriate ioctl for device
gpg: import from '[stdin]' failed: Inappropriate ioctl for device
gpg: Total number processed: 1
gpg:               imported: 1
gpg:              unchanged: 1
gpg:       secret keys read: 1

Funny enough, doing the following will decrypt and output the public and private key on the terminal, with or without the above entry added to the gpg-agent.conf file:

nix-shell -p gnupg --run 'gpg --decrypt --pinentry-mode=loopback < ~/Downloads/backup_2021-09-16.sec.pgp' 
0

I eventually figured it out. You will need to decrypt it first into a text file. When prompted, use the code that was given to you by OpenKeychain when backing up the key:

nix-shell -p gnupg --run 'gpg -o ~/Downloads/backup_2021-09-16_decrypted.txt --decrypt --pinentry-mode=loopback < ~/Downloads/backup_2021-09-16.sec.pgp'

This will save your public and private keys in plain text, which you can confirm with the command cat ~/Downloads/backup_2021-09-16_decrypted.txt.

You can now import the keys with the following command (when prompted, insert the password for this key that you already use elsewhere, in the Password Store app for instance):

nix-shell -p gnupg --run 'gpg --import ~/Downloads/backup_2021-09-16_decrypted.txt'

Which should output something along these lines:

gpg: key 0x10D48E16F953D026: "John Doe <john@doe.com>" not changed
gpg: key 0x10D48E16F953D026: "John Doe <john@doe.com>" not changed
gpg: key 0x10D48E16F953D026: secret key imported
gpg: Total number processed: 2
gpg:              unchanged: 2
gpg:       secret keys read: 1
gpg:   secret keys imported: 1

Notice the secret keys imported line at the end. You can double check with the command gpg --list-secret-keys. If all went well, it should list your key's sec, uid, subkey and fingerprint.

Before that, you may need to enable the gpg-agent in your nixos configuration, like this:

services.gpg-agent = {
  enable = true;
};

This will create a gpg-agent.conf file for you (if you already have one, you will be prompted to either move it out of the way or use 'home-manager switch -b backup' to back it up automatically) with the following line in it:

pinentry-program /nix/store/bv018hrslwj37vpvgjrnqdpr0raj27ik-pinentry-1.1.0-gtk2/bin/pinentry

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.