gpg cannot unlock passphrase-less key: "gpg: public key decryption failed: No passphrase given"

Question

I have a gpg setup started with older gpg versions and I did not use a passphrase back then. I would type enter directly when prompted for it. I'm not sure if that means the key isn't encrypted or if it is encrypted with an empty passphrase.

Regardless, when I try to decrypt something that was sent to me recently, gpg needs access to my private key and prompts me for a passphrase but now I cannot use an empty passphrase anymore. gpg fails with:

$ gpg -d foo.asc
(X dialog that prompts me for passphrase, I just press enter)
gpg: public key decryption failed: No passphrase given
gpg: decryption failed: No secret key

I would like to be able to use my keys again. I don't mind setting a passphrase from now on but I don't know how:

$ gpg --passwd [email protected]
(X dialog that prompts me for current passphrase, I just press enter)
gpg: key xxxxxxxxxxxxxxxx/aaaaaaaaaaaaaaaa: error changing passphrase: No passphrase given
gpg: key xxxxxxxxxxxxxxxx/bbbbbbbbbbbbbbbb: error changing passphrase: No passphrase given
gpg: error changing the passphrase for '[email protected]': No passphrase given

I am running gpg (GnuPG) 2.2.5 and libgcrypt 1.8.2 on openSUSE 15.0.

Answer 1

I solved this by using an older system which had the key.

• I set a new passphrase on the old system where empty-passphrase input works.
• Export old system private key and copy it over new system
• Clean gpg state of new system (move .gnupg to .gnupg.bak)
• Import the non-empty passphrase private key

Here are the commands I ran:

# put a non-empty passphrase on current key
me@old$ gpg --passwd [email protected]
(leave empty on first prompt)
(put a new non-empty passphrase on 2nd)
(confirm new passphrase)

# now we export it

me@old$ gpg --list-secret-keys                               
/home/xxxxx/.gnupg/secring.gpg
-------------------------------
sec   4096R/AAAAAAAA 2015-01-01
uid                  Foo Bar <[email protected]>
uid                  Bar Foo <[email protected]>
ssb   4096R/BBBBBBBB 2015-01-01

# I've used the first key id (should be 8 hex digits)
me@old$ gpg --export-secret-keys AAAAAAAA > priv.key

# copy key over new system

# backup .gnupg dir just in case
me@new$ mv .gnupg .gnupg.back
# import new priv key
me@new$ gpg --import priv.key
(type new passphrase set previously)

# done!

For completeness sake here are the software versions of both systems, maybe that can help someone:

New system (cannot input empty passphrase) software version:

• gpg (GnuPG) 2.2.5
• libgcrypt 1.8.2
• pinentry-curses (pinentry) 1.1.0

Old system (can input empty passphrase) software version:

• gpg (GnuPG) 2.0.24
• libgcrypt 1.6.1
• pinentry-curses (pinentry) 0.8.3

Answer 2

these are three possible solutions, please let us know if/any one works in your case.

Please note: I didn't have the chance to try any of these (I have no empty-password gpg keyring), but researched and searched through the man pages/webpages!

Using passphrase-fd

--passphrase-fd in conjunction with --batch allows you to enter an empty string through the pipe:

echo '' | gpg2 --batch --passphrase-fd 0 your other options

Using Kleopatra

Try using Kleopatra, a graphical certificate manager.

• Select the relevant keypair
• Right-click Change passphrase
• in the popup window leave the field blank (i.e. using an empty password as the current one)
• in the subsequent popup enter the new password and confirm it.

Using pinentry

Also, you could try this solution which leverages the pinentry utility.