gpgconf --reload gpg-agent is one way to force the agent to forget passwords it has cached in memory. Currently (gpg 2.0-2.1) this is [almost] equivalent to pkill -HUP gpg-agent. I say "almost equivalent" since you could, in theory, have more than one agent running and the pkill will try to deliver SIGHUP to all of them.
TTL for cache passwords is controlled by gpg-agent's options:
Set the time a cache entry is valid to n seconds. The default is 600 seconds.
Set the maximum time a cache entry is valid to n seconds. After
this time a cache entry will be expired even if it has been accessed
recently. The default is 2 hours ...
While the answer of thisthatother only shows how to solve it on a Debian system, the approach is the same:
Since Enigmail released version 1.9 on February the 23rd and the problems started from that day on, the only three solutions are:
Wait for Enigmail to sort things out and install their update to the 1.9.x and stop using encryption until ...
Thanks so much for everyone's detailed input on this issue.
I have a similar problem since my system updated to Enigmail 1.9 on Feb 25. I fixed the problem by uninstalling Enigmail 1.9 and switching to 1.8.
For me, this was easy since I use Debian 8 and I simply uninstalled Enigmail as a standalone addon and replaced it with the debian main repo's ...
I spent some time looking into how to fix this, and I published an article about it on my website. Below is a summary of the solution to this question.
1. Identifying the poisoned key
First, we can list the size the public keys in our keyring (in bytes) using the following command (as reported on the GnuPG issue tracker):
user@disp1754:~$ gpg --export | ...
Whether to use PGP/MIME or inline signatures is an per-account setting in Enigmail. To change this option, open the Account Settings, and for each account you want to use PGP/MIME check the Use PGP/MIME by default box.
There might be a set of different problems that occur.
Private key not imported
If you did not migrate the private keys to the new machine, obviously they cannot be used. gpg --export only exports public keys, not private ones. Run gpg --export-secret-keys in addition.
You can verify whether this is an issue by running gpg --list-secret-keys (or the ...
Fedora 22 and 23 already ship GnuPG 2.1, which merged the private keyring into the public keyring. Enigmail interfaces GnuPG 2, so keys created with Enigmail and GnuPG 2.1 are stored in the public keyring file.
Use gpg2 instead of gpg if you can; otherwise you'll have to export the secret keys from gpg2 and import it to GnuPG 1 again:
You're missing the subkey with ID 0xC936E5C0E21E2C3E, but it is included in primary key E443D6D8 and can be downloaded from a key server of your choice:
gpg --recv-keys E443D6D8
OpenPGP-signed messages do not carry the keys with them, but reference them with their ID.
Yes. Check the OpenPGP -> "Use PGP/MIME for this message" menu entry while composing the e-mail.
You can make this option permanent in the Edit -> Account Settings... menu entry.
Choose "OpenPGP Security" in all relevant accounts, and check the "Use PGP/MIME by default" option.
PGP/MIME generates a multi-part MIME message with a plain text part, an HTML part, and a digital signature part. You can verify by using "View -> Message source" and looking for the MIME separators. (See below.)
In Thunderbird, with the message open, click "View -> Message body as" and select "Original HTML." It looks like Thunderbird digitally signs the ...
This is now built into Enigmail:
Go to the Enigmail Key Management window
Click Keyserver → Find keys for all contacts
Go through some self-explanatory dialog boxes
Select the keys you want to import
If you didn't select any keys in step 4, unfortunately the time spent searching for keys is wasted, since you get no warning that you're about to ...
No need to downgrade enigmail plugin :
gpg (GnuPG) 1.4.20
In a terminal :
gpg-agent --daemon /bin/bash
( --use-standard-socket is obsolete)
No need to restart Thunderbird.
Some Theory: Hybrid Cryptography Systems
OpenPGP uses a hybrid cryptography approach: symmetric encryption with the so-called "session key" for encrypting the message itself, and then encrypting the session key with public/private key cryptography, once for each recipient. This is on one hand a performance requirement (public/private key cryptography is ...
Each user's profile page contains a link with their 16-digit PGP key ID:
Clicking it reveals a copy-pastable version of the public keyblock, as well as a link to it:
The key can be imported from a file using gpg --import, or File → Import key from file within Enigmail itself. You can also use Edit → Import ...
but how can I clean the public key locally without having to download a fresh copy (which introduces unnecessary vectors for tampering)?
Run gpg --edit-key <keyid> clean save.
Export the key (or all keys) to a file using --export-options export-clean (which will skip all signatures that can't be verified against ...
Sounds like the file you're trying to import is not your key, but an unrelated file that you found in the new laptop's .gnupg folder.
The only thing it contains is an "emergency" revocation that can be used to mark the key as unusable. (It is meant for use in situations where the public key was sent to keyservers, but you later lost the private key and don'...
It seems you are looking for the "Global auto-type" option? By default you can call it with CTRL+ALT+A (see "Options > Integration" tab):
open Thunderbird as usual (and open the window asking for passphrase).
define the autotype for your entry in Keepass:
edit the entry then go to Auto-type tab and click the "Add" button.
select the Thunderbid window in ...
Go to First, click on the the key on https://keybase.io/username. Next you click on the 64-bit has of the key:
That brings up the dialog:
Right-click on this key and click Save Link As... to download the key-file.
Then you import the key in Kleopatra:
If you are using gpg version older than 2.1.0, problem might be with cypher algorithm CAST5 which produce not MDC-protected message.
Enigmail from version 2.0.4 don't decrypt such emails:
Solution is to upgrade gpg. To read older emails, use parameter --no-mdc-warning as "Additional ...
I figured this out.
It is done via the email account settings. Right click email@example.com, choose settings. Then select openPGP Security. Select use specific PGP Key ID. Select the key you want to use for this email account.
Hope it helps.
I fixed it by following these instructions by enigmail.net:
Check the contents of $HOME/.gnupg/gpg-agent.conf. Make sure that there is a configuration entry pinentry-program containing the full path to a graphical version of pinentry as above. E.g.:
Then save the file.
Add the following line to your $HOME/.gnupg/...
I had the same problem in the sense that Enigmail suddenly threw this error message on every operation after having worked for many months. Disabling the GPG Password Agent component of GNOME Keyring resolved this issue for me – Enigmail then uses the “original” gpg-agent with a pinentry program (instead of the GNOME Keyring passphrase prompt) and everything ...
If you want to have shared GnuPG home directory, the Windows partition is always mounted, an easy, convenient and general solution would be to symlink the Windows GnuPG folder into your home directory. An advantage is you'd also share your trust database, a disadvantage that you might have trouble with permissions.
To do so, remove (after making a backup) ...
Packages to install:
I created the key pair using the enigmail wizard inside Thunderbird.
The pinentry-qt package is used for the passphrase query.
The 'kde-agent' delivers startup and shutdown scripts for the gpg-agent for kde.
Afterwards you can edit
to edit caching times for you ...
None of the other answers would work for me on GnuPG 2.2.19 (Solus 4.1, Nitrokey Smart, gnuk token for storage). I had made sure only one gpg-agent is running, and when appropriate it would respond with OK.
What I ended up doing is:
You should always test, if the above really has made the passwords forgotten by decrypting some encrypted ...