gpg agent and caching symmetric encryption passphrase for writing

Question

With public-key encryption, one can encrypt and decrypt a file repeatedly if gpg-agent caches the passphrase for the key. However, with symmetric encryption I'm always prompted for the passphrase when encrypting even if gpg-agent obviously has the passphrase cached because I'm not prompted when decrypting.

This is related to gpg2 --symmetric and passphrase, but there the OP wants to be prompted always, here I want to be never prompted. Can gpg/gpg-agent be configured to do that?

Answer 1

I also wanted to do this (with symmetric encryption, no keys) and Xen2050's mention of gpg-preset-passphrase was helpful, but I still was stuck on how to derive the correct cacheid to use with gpg-preset-passphrase to associate the passphrase with the encrypted file.

tl;dr the cacheid is the 8-octet hex-encoded s2k salt randomly chosen on encryption, prefixed with the letter "S", e.g. S0123456789ABCDEF:

/path/to/gpg-preset-passphrase --preset S0123456789ABCDEF <<EOF
$PASSPHRASE
EOF

See this detailed answer for instructions on encrypting, getting the cacheid, presetting, and decrypting with passphrase from variable (no prompts at all): https://superuser.com/a/1485486/1093343

Answer 2

Since your commenting "For convenience, but also because I don't want to accidentally change the password and lose information" I'd suggest using a keyfile instead, it won't change. And gpg wouldn't know what cached passphrase you wanted to use when symmetrically encrypting a new file anyway.

But storing and using a keyfile safely becomes an issue. Storing it encrypted should be safe.

• Using a very small LUKS container should store and decrypt it safely
• Or store it encrypted in a gpg file, and extracted to ramfs (note tmpfs could be written to cache).

Then you can close the LUKS container or delete the file whenever you want to, and not worry about entering the passphrase correctly the first time if you only relied on gpg-agent's own caching.

Or, just use a gpg public key.

---

There's also gpg-preset-passphrase to "Put a passphrase into gpg-agent's cache":

The gpg-preset-passphrase is a utility to seed the internal cache of a running gpg-agent with passphrases. It is mainly useful for unattended machines, where the usual pinentry tool may not be used and the passphrases for the to be used keys are given at machine startup.

Passphrases set with this utility don't expire unless the --forget option is used to explicitly clear them from the cache --- or gpg-agent is either restarted or reloaded (by sending a SIGHUP to it). Note that the maximum cache time as set with --max-cache-ttl is still honored. It is necessary to allow this passphrase presetting by starting gpg-agent with the --allow-preset-passphrase.