3

I have a gpg setup started with older gpg versions and I did not use a passphrase back then. I would type enter directly when prompted for it. I'm not sure if that means the key isn't encrypted or if it is encrypted with an empty passphrase.

Regardless, when I try to decrypt something that was sent to me recently, gpg needs access to my private key and prompts me for a passphrase but now I cannot use an empty passphrase anymore. gpg fails with:

$ gpg -d foo.asc
(X dialog that prompts me for passphrase, I just press enter)
gpg: public key decryption failed: No passphrase given
gpg: decryption failed: No secret key

I would like to be able to use my keys again. I don't mind setting a passphrase from now on but I don't know how:

$ gpg --passwd xxxxxxx@xxxxxxx.com
(X dialog that prompts me for current passphrase, I just press enter)
gpg: key xxxxxxxxxxxxxxxx/aaaaaaaaaaaaaaaa: error changing passphrase: No passphrase given
gpg: key xxxxxxxxxxxxxxxx/bbbbbbbbbbbbbbbb: error changing passphrase: No passphrase given
gpg: error changing the passphrase for 'xxxxxxx@xxxxxxx.com': No passphrase given

I am running gpg (GnuPG) 2.2.5 and libgcrypt 1.8.2 on openSUSE 15.0.

  • Changing a passphrase can be done via gpg --passwd email@domain.tld – RubberStamp May 7 at 21:18
  • same problem, I get prompted for the current passphrase, hit enter and get: gpg: key xxxxxxxxxxxxxxxx/aaaaaaaaaaaaaaaa: error changing passphrase: No passphrase given gpg: key xxxxxxxxxxxxxxxx/bbbbbbbbbbbbbbbb: error changing passphrase: No passphrase given gpg: error changing the passphrase for 'xxxxxxx@xxxxxxx.comm': No passphrase given – knarf May 8 at 11:00
  • 1
    Can you use an older version of gpg to dump your private key and then install the new version of gpg then import the private key? – user1794469 May 13 at 20:13
  • this is what i ended up doing thx – knarf May 14 at 9:56
2

I solved this by using an older system which had the key.

  • I set a new passphrase on the old system where empty-passphrase input works.
  • Export old system private key and copy it over new system
  • Clean gpg state of new system (move .gnupg to .gnupg.bak)
  • Import the non-empty passphrase private key

Here are the commands I ran:

# put a non-empty passphrase on current key
me@old$ gpg --passwd xxxx@xxxx.com
(leave empty on first prompt)
(put a new non-empty passphrase on 2nd)
(confirm new passphrase)

# now we export it

me@old$ gpg --list-secret-keys                               
/home/xxxxx/.gnupg/secring.gpg
-------------------------------
sec   4096R/AAAAAAAA 2015-01-01
uid                  Foo Bar <xxxx@xxxxx.com>
uid                  Bar Foo <xxxx@yyyyy.com>
ssb   4096R/BBBBBBBB 2015-01-01

# I've used the first key id (should be 8 hex digits)
me@old$ gpg --export-secret-keys AAAAAAAA > priv.key

# copy key over new system

# backup .gnupg dir just in case
me@new$ mv .gnupg .gnupg.back
# import new priv key
me@new$ gpg --import priv.key
(type new passphrase set previously)

# done!

For completeness sake here are the software versions of both systems, maybe that can help someone:

New system (cannot input empty passphrase) software version:

  • gpg (GnuPG) 2.2.5
  • libgcrypt 1.8.2
  • pinentry-curses (pinentry) 1.1.0

Old system (can input empty passphrase) software version:

  • gpg (GnuPG) 2.0.24
  • libgcrypt 1.6.1
  • pinentry-curses (pinentry) 0.8.3
1

these are three possible solutions, please let us know if/any one works in your case.

Please note: I didn't have the chance to try any of these (I have no empty-password gpg keyring), but researched and searched through the man pages/webpages!

Using passphrase-fd

--passphrase-fd in conjunction with --batch allows you to enter an empty string through the pipe:

echo '' | gpg2 --batch --passphrase-fd 0 your other options

Using Kleopatra

Try using Kleopatra, a graphical certificate manager.

  • Select the relevant keypair
  • Right-click Change passphrase
  • in the popup window leave the field blank (i.e. using an empty password as the current one)
  • in the subsequent popup enter the new password and confirm it.

Using pinentry

Also, you could try this solution which leverages the pinentry utility.

  • 1
    echo '' | gpg2 --batch --passphrase-fd 0 --passwd xxx@xxx.com still prompts using the X dialog and fails the same way. Kleopatra also prompts using the same dialog and fails with empty input (I suspect it just calls gpg in the background). Last solution failed with "gpg: unknown option 'export-reset-subkey-passwd'" – knarf May 14 at 9:16
  • I see, it seems both gpg2 and Kleopatra use the same version of the pinentry utility; the last solution I linked handled with that, but I am glad you managed to solve the problem relying on an old system. – RafDouglas May 14 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.