3

I have been decrypting my GPG-encrypted files for years. My private key was encrypted with a passphrase. Upon attempting to decrypt, a dialog box appeared, asking for my passphrase. This only happened once, and then it would remember my passphrase until logout. That was in Debian wheezy, and, for a few months now, in jessie. (I'm using Debian's default GNOME 3 environment.)

Recently it started decrypting without asking for a passphrase. I attempted to change the passphrase with gpg --edit-key my-key-idand then passwd, but there is no difference. This first asked my for the existing passphrase before going on to ask me to enter, twice, the new passphrase. But gpg -d some_encrypted_file will always work, immediately after reboot, without asking for a passphrase.

It seems the gpg-keyring-daemon is at fault. If I try unset GPG_AGENT_INFO; gpg -d some_encrypted_file, then it asks for the passphrase, otherwise it does not decrypt.

Update: Somehow, in dconf-editor, desktop.gnome.crypto.cache.gpg-cache-method was set to always. I changed it to session but there is no difference.

  • 1
    If you're running the Gnome keyring manager, very likely this is acting as gpg-agent, and you're looking for the culprit in the wrong corner. – Jens Erat Feb 10 '15 at 12:24
  • Thanks! You are right. Somehow, in dconf-editor, desktop.gnome.crypto.cache.gpg-cache-method was set to always. I changed it to session but there is no difference. – Antonis Christofides Feb 10 '15 at 12:43
  • I have the impresson that dconf-editor doesn't apply as pinentry will store it anyway, whatever the value of desktop.gnome.crypto.cache.gpg-cache-method is – Olivier Berger Apr 27 '18 at 11:53
4

I believe I found out what was going on.

When the dialog box asking for the passphrase appears (I think the dialog box is an application called pinentry), it has a check box that reads "Automatically unlock this key whenever I'm logged in". If you (accidentally) check that check box, it then does two things: (a) It registers the decision to automatically unlock this key; (b) It stores your passphrase.

So now you need to undo these two things.

First, you go to dconf-editor and set desktop.gnome.crypto.cache.gpg-cache-method to its default value, session, instead of always.

Second, you go to the application "Passwords and keys" (i.e. seahorse, yes, I'm quite confused), Passwords, Login, and you delete the stored passphrase.

(All this is certainly no good candidate for a usability contest.)

  • Deleting the stored passphrase means starting seahorse, going to the Passwords main section in the left column, then under its login "drawer", one lists all the stored credentials. Finding the saved GnuPG passphrase can be eased by filtering with "gnupg". Hope this clarifies – Olivier Berger Apr 27 '18 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.