With public-key encryption, one can encrypt and decrypt a file repeatedly if gpg-agent caches the passphrase for the key. However, with symmetric encryption I'm always prompted for the passphrase when encrypting even if gpg-agent obviously has the passphrase cached because I'm not prompted when decrypting.

This is related to gpg2 --symmetric and passphrase, but there the OP wants to be prompted always, here I want to be never prompted. Can gpg/gpg-agent be configured to do that?

  • What is your question? – Tom K. Jan 23 '18 at 12:43
  • So you want gpg-agent to cache the same passphrase to be used every time you're encrypting any file symmetrically? – user8675309 Jan 24 '18 at 22:34
  • Yes. For convenience, but also because I don't want to accidentally change the password and lose information. – melisgl Jan 26 '18 at 13:50

I also wanted to do this (with symmetric encryption, no keys) and Xen2050's mention of gpg-preset-passphrase was helpful, but I still was stuck on how to derive the correct cacheid to use with gpg-preset-passphrase to associate the passphrase with the encrypted file.

tl;dr the cacheid is the 8-octet hex-encoded s2k salt randomly chosen on encryption, prefixed with the letter "S", e.g. S0123456789ABCDEF:

/path/to/gpg-preset-passphrase --preset S0123456789ABCDEF <<EOF

See this detailed answer for instructions on encrypting, getting the cacheid, presetting, and decrypting with passphrase from variable (no prompts at all): https://superuser.com/a/1485486/1093343

| improve this answer | |

Since your commenting "For convenience, but also because I don't want to accidentally change the password and lose information" I'd suggest using a keyfile instead, it won't change. And gpg wouldn't know what cached passphrase you wanted to use when symmetrically encrypting a new file anyway.

But storing and using a keyfile safely becomes an issue. Storing it encrypted should be safe.

  • Using a very small LUKS container should store and decrypt it safely
  • Or store it encrypted in a gpg file, and extracted to ramfs (note tmpfs could be written to cache).

Then you can close the LUKS container or delete the file whenever you want to, and not worry about entering the passphrase correctly the first time if you only relied on gpg-agent's own caching.

Or, just use a gpg public key.

There's also gpg-preset-passphrase to "Put a passphrase into gpg-agent's cache":

The gpg-preset-passphrase is a utility to seed the internal cache of a running gpg-agent with passphrases. It is mainly useful for unattended machines, where the usual pinentry tool may not be used and the passphrases for the to be used keys are given at machine startup.

Passphrases set with this utility don't expire unless the --forget option is used to explicitly clear them from the cache --- or gpg-agent is either restarted or reloaded (by sending a SIGHUP to it). Note that the maximum cache time as set with --max-cache-ttl is still honored. It is necessary to allow this passphrase presetting by starting gpg-agent with the --allow-preset-passphrase.

| improve this answer | |
  • Could you point to some resources for creating a symmetric keyfile with gpg? – winduptoy Dec 26 '18 at 14:52
  • @MattReyer I've read general good advice for linux is to read a few random bytes (32, 64, 128, 256, depends on the cipher & perhaps key processing) from /dev/random on a running well-used system (an embedded system with virtually no input may have poor "randomness"). Cryptsetup's FAQ 2.12 What are the security requirements for a key read from file? has head -c 256 /dev/random > keyfile – Xen2050 Dec 26 '18 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.