2

I forgot my GPG key passphrase.

I know my computer is storing it somewhere because I decrypt strings with it, without a password, for example:

$ gpg --decrypt -r me@example.com ~/.password-store/gmail.gpg 
You need a passphrase to unlock the secret key for
user: "Example <me@example.com>"
2048-bit RSA key, ID 02BFF027, created 2014-10-04 (main key ID 410A4C4A)
gpg: NOTE: secret key 02BFF027 expired at Thu  4 Oct 17:30:49 2018 EDT
gpg: encrypted with 2048-bit RSA key, ID 02BFF027, created 2014-10-04
      "Example <me@example.com>"
princess

The above output manages to decrypt ~/.password-store/gmail.gpg; it knows my key is expired and it knows it needs a passphrase, but somehow it manages to decrypt the string nonetheless (my password is not "princess", this is just for illustration purposes).

I am assuming GPG Agent is being used to pass the passphrase to gpg.

Is it possible to do something like:

gpg-agent --display-passphrase 02BFF027

?

2
  • I thought it only saved the passphrase like that for a limited time... I'm not sure about recovering it now, but a good reminder to keep a backup copy in the future – Xen2050 Oct 14 '18 at 8:01
  • Expired keys are perfectly fine to use... the expiration date can be changed at any time... However, the question is a bit unclear... Do you know the passphrase? Do you want to change the expiration date? Are you somehow decrypting data without entering your passphrase? If the passphrase is cached somehow, you may be able to change it without entering in the old one gpg --passwd 02BFF027 – RubberStamp Oct 18 '18 at 15:35
0

The passphrase itself is not stored anywhere and thus cannot be displayed.

The decryption process works anyway by repeatedly applying a secure hash algorithm to a concatenation of the passphrase being input and a salt value (a random number) read from the key ring.
This (computationally intensive) process returns the master key to decrypt the key ring.
If the password is correct, you can decrypt the key ring including the key to decrypt the mail message.
If the password is wrong, you get a wrong master key which fails validation and thus results in an error message (and failure to decrypt the mail message because its encryption key is not extracted from the key ring).

0

Wikipedia:

Historically a password was stored in plaintext on a system, but over time additional safeguards developed to protect a user's password against being read from the system. A salt is one of those methods. A new salt is randomly generated for each password ... [and] concatenated and processed with a cryptographic hash function, and the resulting output (but not the original password) is stored with the salt in a database.

A hash is not reversible. So the password cannot easily be recovered from the hash. The hash is used to decrypt the secret key, which in turn is used to decrypt the file/message.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.