Pass tomb's documentation states

pass tomb [-n] [-t time] [-f] [-p subfolder] gpg-id...
    Create and initialise a new password tomb
    Use gpg-id for encryption of both tomb and passwords

If so, then why is a keyfile created for the tomb? Would someone be able to open the tomb if they had the tomb and this keyfile?


Per their site:

Tomb generates encrypted storage folders to be opened and closed using their associated keyfiles, which are also protected with a password chosen by the user.

because pass tomb is

  1. Asking for a gpg identity and not a password


  2. Created to keep your password tree encrypted when you are not using it (source)

they must be using the gpg public key to encrypt the tomb key.

If that's the case then no, having only the tomb key and the tomb aren't enough to access the tomb (unless they've broken gpg). If someone had the tomb, the tomb key, and the gpg private key they'd have not only the tomb, but the password files as well (since the same gpg identity is used to encrypt them).

You could always test by generating a new gpg keypair, creating a pass tomb using that identity and deleting the private key to be sure (don't trust me, I'm just some person on the internet).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.