How to get PGP key passphrase out of Thunderbird?

Question

I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it stored somewhere. How can I get it?

I already know that the password, with which encrypted-openpgp-passphrase.txt – the file that actually has my forgotten passphrase – is encrypted, is stored in key4.db, but I were unable to figure it out by reading key4.db – both with a SQLite browser and with cat. The program firefox-decrypt is not helpful since it only gives me the login credentials for my e-mail-server.

Answer 1

Per request, comment to answer:

One of the Thunderbird developers said:

"If you have the private key in Thunderbird, then you can use Thunderbird Key Manager to create a backup of your private key. Once you have the OpenPGP key manager open, select the key you need, then use the file menu and create a backup of that key. You will be asked to protect the exported key with a password that will be created. Once you are done creating the file, use your other software to import it, and enter the same password to unlock it."

Answer 2

This is a preliminary answer. If you want to know Thunderbird's generated passphrase, it is indeed a 32-char hex string encrypted in encrypted-openpgp-passphrase.txt. You can decipher it using firepwd code:

pp = decodeLoginData(<encrypted passphrase>)
assert pp[0] == CKA_ID
iv = pp[1]
ciphertext = pp[2]
passphrase = unpad( DES3.new( key, DES3.MODE_CBC, iv).decrypt(ciphertext),8 )

Append this at the end of firepwd.py then do python firepwd.py -d ~/.thunderbird/<your profile>.

But this passphrase won't work on GnuPG. If you backup your secret key, the passphrase won't work as well on GnuPG. Because the OpenPGP implementations of RNP (used by Thunderbird) and GnuPG are different. I managed to decrypt a mail using RNP, using the passphrase of the backup secret key.

(I am currently investigating why it does not work. It may be a matter of GNOME keyring cache.)

Answer 3

What OS are we talking about? If it's Ubuntu Linux, have you tried the following:

1. Install pip and gnome-keyring: apt-get install python-pip python-gnomekeyring
2. Clone or install the following repo: https://github.com/kparal/gkeyring
   • sudo pip install --upgrade --user gkeyring
3. Now search in the dash (click Ubuntu logo) for "Passwords and Keys" application (this is Seahorse).
4. Under the subsection called "Passwords" click the item "Login". You should see your PGP key with a lock.
5. Right-click, select Properties. Then copy the Description field (CTRL-C).
6. Now in the terminal, type: $ ./gkeyring --name "..."
   • Keep the quotes, and paste that description where the ... is. It should look something like: $ ./gkeyring --name "PGP Key: John Smith <***@smith.com>"
7. When you press enter it will display your password