GnuPG decryption not asking for passphrase
Does it store the secret key somewhere and uses it (I also stored my secret key in the GnuPG key chain, does it uses that)?
GnuPG only uses keys from your key chain, so it must be in there to use it.
How can I force the system to ask the passphrase every time?
Old versions of GnuPG uses the gpg-agent
, which caches the passphrase for a given time. Use the option --no-use-agent
or add a line no-use-agent
to ~/.gnupg/gpg.conf
to prevent using the agent.
For newer versions (v2.1+), disable password caching for the agent by creating ~/.gnupg/gpg-agent.conf
and adding the following lines:
default-cache-ttl 1
max-cache-ttl 1
Restart the agent with:
echo RELOADAGENT | gpg-connect-agent
GnuPG 2.2.15
--symmetric -c Encrypt with a symmetric cipher using a passphrase. The default sym- metric cipher used is AES-128, but may be chosen with the --cipher-algo option. This command may be combined with --sign (for a signed and sym- metrically encrypted message), --encrypt (for a message that may be decrypted via a secret key or a passphrase), or --sign and --encrypt together (for a signed message that may be decrypted via a secret key or a passphrase). gpg caches the passphrase used for symmetric encryption so that a decrypt operation may not require that the user needs to enter the passphrase. The option --no-symkey-cache can be used to disable this feature.
# encrypt files
gpg -c --no-symkey-cache file.txt
# decrypt files
gpg --no-symkey-cache file.txt.gpg
with --no-symkey-cache option, it will not cache your password
Encrypting a "test" file should give us test.gpg
# gpg -c test
But no, we get some errors.
gpg: problem with the agent: Permission denied
gpg: error creating passphrase: Operation cancelled
gpg: symmetric encryption of 'test' failed: Operation cancelled
Loopback mode to the rescue!
# gpg -c --pinentry-mode=loopback test
It prompts for your password and works as expected.
When it comes time to decrypt, maybe you change users and get an error:
gpg: problem with the agent: Permission denied
Loopback mode to the rescue!
# gpg --pinentry-mode=loopback test.gpg
Tested with...
gpg (GnuPG) 2.2.20
libgcrypt 1.8.5
IMO --pinentry-mode=loopback
and --no-symkey-cache
should be the default settings. I found the solution here https://askubuntu.com/a/1158297/429995 and the "anonymous" answer here (to not cache the password) was helpful as well.