32

I've some stuff encrypted with GnuPG using gpg -e. When I decrypt them, the system does not ask for the passphrase, it decrypts it straight away.

Does it store the secret key somewhere and uses it (I also stored my secret key in the GnuPG key chain, does it uses that)?

How can I force the system to ask the passphrase every time?

30

Does it store the secret key somewhere and uses it (I also stored my secret key in the GnuPG key chain, does it uses that)?

GnuPG only uses keys from your key chain, so it must be in there to use it.

How can I force the system to ask the passphrase every time?

Old versions of GnuPG uses the gpg-agent, which caches the passphrase for a given time. Use the option --no-use-agent or add a line no-use-agent to ~/.gnupg/gpg.conf to prevent using the agent.

For newer versions (v2.1+), disable password caching for the agent by creating ~/.gnupg/gpg-agent.conf and adding the following lines:

default-cache-ttl 1
max-cache-ttl 1

Restart the agent with:

echo RELOADAGENT | gpg-connect-agent
  • 8
    Note that for gpg2 "--no-use-agent" is an obsolete option - it has no effect. – 10 cls Nov 19 '16 at 17:36
  • To be more specific, it is obsolete for GnuPG 2.1 (and newer). – Jens Erat Nov 30 '16 at 18:17
  • 2
    0 seems to mean no caching at all, as it correctly asks for passphrase even immediately after encrypting. I just wanted to add that the correct way to reload gpg-agent would be echo RELOADAGENT | gpg-connect-agent – Jeffrey Lebowski Jan 10 '17 at 13:01
  • 8
    It might be noteworthy that gpg-agent also caches passphrases used with gpg --symmetric, which allows anyone with access to the shell / gpg-agent-session to decrypt the file without entering the passphrase. – fbmd Jan 14 '17 at 11:33
  • 1
    GnuPG does not read a system-wide configuration file, so you need to roll out the configuration for all existing users and create it when creating new users (skeleton folder on Linux, don't know how to do so in Windows). – Jens Erat Aug 24 '18 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.