31

I am trying to decrypt a file with GnuPG, but when using the command below:

gpg --decrypt filename.gpg

I get the following message:

gpg: encrypted with RSA key, ID 3662FD5E
gpg: decryption failed: No secret key

I already have the private key with which the file has been encrypted, but I am not sure how can I specify it. Is there any option I can include when doing the decryption to point to this key?

4
  • 1
    What does gpg --list-secret-keys 0x3662FD5E print? – Jonas Schäfer May 28 '15 at 15:18
  • No, it doesn't. Is there any way I can add it? – Crista23 May 28 '15 at 15:21
  • How did you obtain the private key? – Jonas Schäfer May 28 '15 at 15:36
  • What does this ID actually represent? – Nishant Aug 1 '18 at 16:17
27

I already have the private key with which the file has been encrypted, but I am not sure how can I specify it.

I understand this as "I've got a file containing the private key, but do not know how to tell GnuPG to use it".

GnuPG requires keys (both public and private) to be stored in the GnuPG keyring. This is as easy as

gpg --import [keyfile]

Afterwards, you should be able to decrypt the file exactly the way you already tried.

5
  • 7
    So is gpg smart enough to know which key to decrypt once you have several keys imported? – RollRoll Aug 11 '16 at 0:20
  • Yes. Usually the key is even referenced in the encrypted file, if not GnuPG tries all keys. – Jens Erat Aug 11 '16 at 15:35
  • 1
    I use GnuPG programmatically and have a keyring with hundreds of private keys and message may be encrypted with dozens of them. It seems a bit wasteful that it just tries them all (actually it tries to unlock them all using the given passphrase and takes the first one that works). – jlh Oct 25 '17 at 8:24
  • 2
    GnuPG only tries them all if the key was hidden by the sending party. It feels your use case was not one of the design targets of GnuPG. If you know the correct private key although it is not stored in the encrypted file, consider managing different GnuPG home directories/keyrings with a single private key instead. – Jens Erat Oct 25 '17 at 20:42
  • Yes, it seems that my use case isn't well suited for gpg. For completeness here's a more detailed observation: My recipient IDs are not hidden (not using -R), so gpg knows which of the maybe a dozen keys it should try, it doesn't have to try the entire keyring. However gpg doesn't know for which key I supplied the passphrase, so it does have to try those dozen keys, which slows down things considerably. – jlh Sep 20 '18 at 11:49
8
bash-4.2$ gpg --import b_secret.key
gpg: key 23E7859B: already in secret keyring
gpg: Total number processed: 1
gpg:       secret keys read: 1
gpg:  secret keys unchanged: 1
bash-4.2$ gpg --decrypt b_txt.asc
gpg: key 23E7859B: secret key without public key - skipped
gpg: encrypted with RSA key, ID 04702E37
gpg: decryption failed: secret key not available
1
  • 3
    Welcome to SuperUser, your suggestion is already in another answer. You should upvote that answer instead of making new one. You don't have enough reputation to do that yet, wait until you do. – Vlastimil Ovčáčík Dec 4 '15 at 11:02
2

You don't need to expressly declare the secret key in the gpg decrypt command. If the keypair- both Public AND Private keys- as Jens states are present on the keyring on the host where you're decrypting, GPG will automagically determine the secret key required for decryption and present a password challenge.

HOWEVER if you wish to try all (non-cached) keys (maybe you're testing a file encrypted with multiple keys), using the switch --try-all-secrets will cycle through all the secret keys on your keyring trying them in turn. ie:

gpg -d --try-all-secrets test-gpg.txt.asc

HTH- Terrence

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.