GNU bug report logs - #15552
24.3.50; epa-file-cache-passphrase-for-symmetric-encryption not respected with GnuPG 2.x

Previous Next

Full log

Message #33 received at 15552 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Monnier <monnier <at> iro.umontreal.ca>
To: Daiki Ueno <ueno <at> gnu.org>
Cc: tzz <at> lifelogs.com, 15552 <at> debbugs.gnu.org
Subject: Re: bug#15552: 24.3.50;
 epa-file-cache-passphrase-for-symmetric-encryption not respected with
 GnuPG 2.x
Date: Tue, 08 Oct 2013 23:01:58 -0400

> It used to work like that with gpg1.  However, gpg2's implementation
> choice is that it does not leak the indication that gpg2 (actually
> gpg-agent) requires passphrase and it does not allow other tools than
> pinentry to inject passphrase.

IOW epa-file-cache-passphrase-for-symmetric-encryption only works for
gpg1 and not for gpg2?

> IMO that's a good idea for security (as pinentry uses secmem).

There are many situations where local security is not nearly as
important as convenience.  But IIUC with gpg2 the general answer is "use
gpg-agent to do the caching", and it's supposed to work fine (i.e. it's
just as convenient as caching the password in Emacs).

>> Stefan "Also confused about what "symmetric" has to do with it"
> Perhaps you could try the above recipe under gpg-agent is properly set up:
> $ echo abc > file
> $ gpg --symmetric file
> $ eval `gpg-agent --daemon`
> $ gpg2 < file.gpg
> $ gpg2 < file.gpg
> You won't be asked for the passphrase at the second time, because
> gpg-agent remembers passphrase based on the file content.

That doesn't really explain to me why
epa-file-cache-passphrase-for-symmetric-encryption has "symmetric" in
its name and more specifically why caching of passphrases would be
different for symmetric than for public key cryptography.


        Stefan

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.