5

I used Emacs to encrypt a text file with a symmetric key. When decrypting the file, the program pinentry opens a window for password entry. I accidentally clicked the checkbox for "save in password manager" and then the enter key (no password). Apparently the empty password was stored and now I'm not anymore prompted for a password when opening the file. Instead I get the following error message:

gpg: AES encrypted data
gpg: gcry_kdf_derive failed: Invalid data
gpg: encrypted with 1 passphrase
gpg: decryption failed: No secret key

I get this message when opening the file in Emacs but also when I use gpg2 -d the_file.gpg.

How can I remove the empty password and restore the password prompt?

Things that I already tried (unsuccessfully):

  • reboot,
  • kill gpg-agent,
  • kill gnome-keyring-daemon,
  • remove the key using seahorse (didn't work because seahorse didn't list the key)

I'm using Xubuntu 16.04.

tmalsburg
  • 151
  • 1
  • 4
  • Tried using gpg with the `--no-use-agent` flag? Maybe add a few `-v` too, it's not clear what users / keys / passphrases are used. – Xen2050 Jul 06 '16 at 01:04
  • In gpg2, `--no-use-agent` is obsolete and has no effect. When I add `-v`, I get the exact same output as without it. – tmalsburg Jul 06 '16 at 02:11
  • Not super familiar with gpg2, searched the man page? gpg should allow --no-use-agent, try it? – Xen2050 Jul 06 '16 at 20:43
  • I did search the man page. It says that `--no-use-agent` is obsolete and doesn't do anything. – tmalsburg Jul 07 '16 at 05:19
  • I meant to try gpg, not gpg2. I'd assumed that gpg2 would have had some similar functionality, guess not. What's the root of your problem, that some password agent won't let you actually type in a password? Is the agent/program that's saving the pw emacs itself, or what's it named? What would I install (with apt) to get an identical setup? Must have config files to erase somewhere... Sounds like a bad bug if it won't ask you for a new password when the saved one fails. Is the file really encrypted with a blank, or newline, password? – Xen2050 Jul 07 '16 at 23:14

1 Answers1

1

Ubuntu 16.04 and derivatives currently come with GPG 2.1.11, which cannot be used without an agent. Moreover, since 2.1, the agent socket file is fixed to ${GPG_HOMEDIR}/S.gpg-agent. The reason I'm saying this is because I don't know exactly how gpg-agent and gnome-keyring battle for acting as agents by owning that file, but only one can own it at any one time.

The fact there was a check box for saving the password suggests you weren't using pinentry via gpg-agent, but Seahorse via gnome-keyring. I suggest reading the "Managing Passwords" section, and trying to find the bad association (empty pass for that specific file) that way.

Since you mentioned looking for a key in Seahorse- If you are using symmetric encryption, the password will not be associated with any GPG encryption key. (I find GPG to be lacking in that respect, details here.)

Community
  • 1
Matei David
  • 665
  • 5
  • 15
  • 1
    Thanks for your response. I found that the key used for symmetric encryption was in fact stored in Gnome's keyring. But the name of the key was not the file name but some checksum, so it was not easily possible find out which key was the one that I had to delete. I see why they used a checksum (you want the key to work even after moving the file and you don't want the key to work with other files moved to the path of the original file) but it's nevertheless a pretty dysfunctional UI. – tmalsburg Aug 05 '16 at 22:52