I encrypted one file with gpg -c <file>
and closed the terminal. After a while, I tried to decrypt it with gpg <file>
and it decrypted it, without asking for a password. Is that normal? How to guarantee that gpg will ask for a password, even in my same computer?
5 Answers
This is normal, gpg
now uses gpg-agent
to manage private keys, and the agent caches keys for a certain amount of time (up to two hours by default, with a ten minute inactivity timeout).
To change the defaults, create or edit a file named ~/.gnupg/gpg-agent.conf
, and use the following entries:
default-cache-ttl
specifies the amount of time a cache entry is kept after its last use, in seconds (600 by default);max-cache-ttl
specifies the maximum amount of time a cache entry is kept, in seconds (7200 by default).
After changing these, you’ll need to reload the configuration (try sending SIGHUP
to gpg-agent
, or killing it outright).
To make gpg >=2.1 always ask for a passphrase, run it with gpg --pinentry-mode loopback
.
To make gpg >=2.2.7 always ask for a passphrase for --symmetric
(-c
) encryption, run it with gpg --no-symkey-cache
.
-
1
--no-symkey-cache
worked, but it's not on the help list of commands. Any idea why? Version is 2.2.19, Ubuntu 20-4. Jan 3 at 19:36 -
@EvandroPomatti it is displayed via the
man
command underneath the--symmetric
option, as mentioned by @anonymous– ajmeese7Jun 12 at 17:23
GnuPG 2.2.15
--symmetric -c Encrypt with a symmetric cipher using a passphrase. The default sym- metric cipher used is AES-128, but may be chosen with the --cipher-algo option. This command may be combined with --sign (for a signed and sym- metrically encrypted message), --encrypt (for a message that may be decrypted via a secret key or a passphrase), or --sign and --encrypt together (for a signed message that may be decrypted via a secret key or a passphrase). gpg caches the passphrase used for symmetric encryption so that a decrypt operation may not require that the user needs to enter the passphrase. The option --no-symkey-cache can be used to disable this feature.
# encrypt files
gpg -c --no-symkey-cache file.txt
# decrypt files
gpg --no-symkey-cache file.txt.gpg
with --no-symkey-cache option, it will not cache your password
-
@Kusalananda♦ I think my answer "guarantee that gpg will ask for a password", every time Nov 25, 2019 at 4:18
-
Apologies, I missed the fact that the user mas doing symmetric encryption.– Kusalananda ♦Nov 25, 2019 at 6:02
-
2
-
1This works but
--no-symkey-cache
doesn't show as an option in the help, I'm using 2.2.19. Jan 3 at 19:38
Just adding up... I use this simple function on my .bashrc
, so that every time I want to force the password to be prompted again I can easily do so by just running gpg-reload
from my terminal instead of waiting for the cache to be automatically cleared:
gpg-reload(){
pkill scdaemon
pkill gpg-agent
gpg-connect-agent /bye >/dev/null 2>&1
gpg-connect-agent updatestartuptty /bye >/dev/null 2>&1
gpgconf --reload gpg-agent
}
Hope it helps!
-
1It would be better to use
gpgconf --kill all
in place of thosekill -9
calls that you have. It's never a good idea to usekill -9
, and if you really need to signal something based on its name,pkill
would be a better tool.– Kusalananda ♦Sep 26, 2019 at 15:53 -
1was not aware of
--kill all
option, seems on gpgconf version 2.0.22, which I'm using right now, this option is not available.... Indeed, "kill -9" might be a bit rude... updating the response to usepkill
as suggested, since its a better way to handle it :-) thx for the input! Sep 26, 2019 at 18:07 -
Is your private key tied to a password? This is something you set at key creation time.
If not, GPG won't ask for a password, as none is required. It will simply rely on the key you provide.
And if so, should you have entered your password during another operation right before, GPG will not ask for this password again until a few minutes have passed.
gpg-agent
caches it for 10 minutes by default (GnuPG 2.2).