4

I've found today, that enigmail is decrypting a message without asking me for the smart card's PIN. It is asking only once, and then not ask at all.

this is my gpg-agent.conf:

default-cache-ttl 0
max-cache-ttl 0
no-allow-external-cache
ignore-cache-for-signing

scdaemon.conf:

card-timeout 0
deny-admin

gpg.conf is empty

gpg (GnuPG) 2.1.16

libgcrypt 1.7.3-beta

Gnome keyring is stopped. What am I missing here?

  • Does setting the timeout to 1 second not prompt you for every attempt? – dragon788 Nov 8 '17 at 17:14
8

I've been looking into this myself. I want to be prompted to enter my PIN every time I request my smart card (Yubikey in my case) to do a sign/encrypt/auth operation. It is possible to enable this behaviour for signing by enabling forcesig through gpg2 --card-edit (see GnuPG documentation):

forcesig   toggle the signature force PIN flag

but not for encryption and authentication operations.

This post on the GnuPG mailing list by Werner Koch himself seems to imply that the smart card itself is caching the PIN.

I will look into this further (perhaps send an email to the GnuPG mailing list) and update this answer if I find any more information.

  • I suggest enabling touch verification (a yubikey setting) on all operations. That seems to provide better security, since it cannot be remembered or phished. – Scott Feb 7 '18 at 19:50
  • You can just stop and restart your gpg-agent every x # of mins to force pin re-entry. – user196817 Jan 14 at 22:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.