Releases of gnupg from 2.1.16 (currently 2.1.17) block waiting for entropy only on first invocation.
Note: this isn't an attempt to generate a key, just to decrypt a file and start the agent.
The first time gpg-agent is started, either directly with
gpg2 file.gpg or using an application like
pass, pinentry appears and once I enter my passphrase and hit Enter it hangs for around 15s.
All subsequent calls, within the window of the default-cache-ttl, are executed immediately.
--debug-all mode, the period where the hang occurs prints1:
gpg: DBG: chan_6 <- S PROGRESS need_entropy X 30 120 gpg: DBG: chan_6 <- S PROGRESS need_entropy X 120 120 gpg: DBG: chan_6 <- S PROGRESS need_entropy X 30 120 gpg: DBG: chan_6 <- S PROGRESS need_entropy X 120 120 gpg: DBG: chan_6 <- S PROGRESS need_entropy X 30 120 ...
I installed rng-tools to supplement the entropy pool:
cat /proc/sys/kernel/random/entropy_avail 4094
and compared with a machine with the same version of gnupg that did not have rng-tools or haveged installed, that exhibits no delay:
cat /proc/sys/kernel/random/entropy_avail 3783
So there appears to be sufficient entropy in the pool. This was tested on kernels 4.8.13 and 4.9.
Does gpg use a different pool? How can I provide sufficient entropy, or otherwise eliminate the 15s delay when starting the agent?
1. The full debug log.