3

I have been decrypting my GPG-encrypted files for years. My private key was encrypted with a passphrase. Upon attempting to decrypt, a dialog box appeared, asking for my passphrase. This only happened once, and then it would remember my passphrase until logout. That was in Debian wheezy, and, for a few months now, in jessie. (I'm using Debian's default GNOME 3 environment.)

Recently it started decrypting without asking for a passphrase. I attempted to change the passphrase with gpg --edit-key my-key-idand then passwd, but there is no difference. This first asked my for the existing passphrase before going on to ask me to enter, twice, the new passphrase. But gpg -d some_encrypted_file will always work, immediately after reboot, without asking for a passphrase.

It seems the gpg-keyring-daemon is at fault. If I try unset GPG_AGENT_INFO; gpg -d some_encrypted_file, then it asks for the passphrase, otherwise it does not decrypt.

Update: Somehow, in dconf-editor, desktop.gnome.crypto.cache.gpg-cache-method was set to always. I changed it to session but there is no difference.

Improve this question
3
  • 1
    If you're running the Gnome keyring manager, very likely this is acting as gpg-agent, and you're looking for the culprit in the wrong corner.
    – Jens Erat
    Feb 10, 2015 at 12:24
  • Thanks! You are right. Somehow, in dconf-editor, desktop.gnome.crypto.cache.gpg-cache-method was set to always. I changed it to session but there is no difference.
    – Antonis Christofides
    Feb 10, 2015 at 12:43
  • I have the impresson that dconf-editor doesn't apply as pinentry will store it anyway, whatever the value of desktop.gnome.crypto.cache.gpg-cache-method is
    – Olivier Berger
    Apr 27, 2018 at 11:53

1 Answer 1

Reset to default
4

I believe I found out what was going on.

When the dialog box asking for the passphrase appears (I think the dialog box is an application called pinentry), it has a check box that reads "Automatically unlock this key whenever I'm logged in". If you (accidentally) check that check box, it then does two things: (a) It registers the decision to automatically unlock this key; (b) It stores your passphrase.

So now you need to undo these two things.

First, you go to dconf-editor and set desktop.gnome.crypto.cache.gpg-cache-method to its default value, session, instead of always.

Second, you go to the application "Passwords and keys" (i.e. seahorse, yes, I'm quite confused), Passwords, Login, and you delete the stored passphrase.

(All this is certainly no good candidate for a usability contest.)

Improve this answer
1
  • Deleting the stored passphrase means starting seahorse, going to the Passwords main section in the left column, then under its login "drawer", one lists all the stored credentials. Finding the saved GnuPG passphrase can be eased by filtering with "gnupg". Hope this clarifies
    – Olivier Berger
    Apr 27, 2018 at 11:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .