I have a file which I edit and encrypt following this guide. I'm a noob as far as security goes and thought that the point of including the line which specifies the cryptographic key to use

-*- mode: org -*- -*- epa-file-encrypt-to: ("my_key_email@foo.org") -*- 

would therefore require me (specified by my email) to enter in my passphrase. However, it seems that I'm doing things wrong as I'm instead doing symmetric encryption instead. I know I'm doing symmetric encryption because I am never prompted for my_key_email@foo.org's passphrase. I can list the keys in emacs and my email shows up in the list when I "M-x epa-list-keys"

Can someone point out where I'm going wrong such that I can use my passphrase to encrypt the files? I want to prevent locking myself out by accidentally encrypting the file with a new password, which sadly has happened. :( And from what I've read so far, cracking the file is dang near impossible.

For completeness sake here is my .emacs file

(require 'whitespace)
(setq whitespace-style (quote (spaces tabs newline space-mark tab-mark newline-mark)))

;; EasyPG
(require 'epa)

(defadvice epg--start (around advice-epg-disable-agent disable)
"Make epg--start not able to find a gpg-agent"
(let ((agent (getenv "GPG_AGENT_INFO")))
(setenv "GPG_AGENT_INFO" nil)
(setenv "GPG_AGENT_INFO" agent)))
;;(setenv "GPG_AGENT_INFO" pinentry)))

(defun epg-disable-agent ()
  "Make EasyPG bypass any gpg-agent"
  (ad-enable-advice 'epg--start 'around 'advice-epg-disable-agent)
  (ad-activate 'epg--start)
  (message "EasyPG gpg-agent bypassed"))

(defun epg-enable-agent ()
  "Make EasyPG use a gpg-agent after having been disabled with epg-disable-agent"
  (ad-disable-advice 'epg--start 'around 'advice-epg-disable-agent)
  (ad-activate 'epg--start)
  (message "EasyPG gpg-agent re-enabled"))

;;added to overcome bug in gnupg2 in Arch linux as pointed out here: http://www.emacswiki.org/emacs/EasyPG
(when (file-executable-p "/usr/bin/gpg1")
(setq epg-gpg-program "/usr/bin/gpg1"))
  • I'm assuming that you generated keys? gpg --key-gen – schroeder Jun 25 '13 at 21:40
  • 1
    I believe that I was using keys created using ssh-keygen. All three computers have a combination of rsa and/or edcsa keys in .ssh/ – N Klosterman Jun 27 '13 at 15:56
  • 3
    ssh keys != gpg keys. – Jürgen A. Erhard Aug 19 '13 at 9:38
  • 2
    With public key encryption you don't need a passphrase to encrypt a file only to decrypt it. Your inference that you are using symmetric encryption seems insufficiently evidenced. This seems unlikely to happen by accident. An alternative explanation might be that your attempts to disable gnupg-agent have failed and the agent is caching the key after an earlier use of a password. I would try killing any gpg-agent and then try to read the file in again to verify. – William Hay Sep 14 '18 at 20:00
  • 1
    @WilliamHay: Your comment should be an answer. – Esa Jokinen Jan 20 '19 at 13:50

You already seem to be doing public key encryption.

In public key encryption, the data is encrypted with the public key and it is decrypted with the private key. The password is only used to protect the private key. The public key is public for anyone to use, therefore it is normal that you are not requested a password when encrypting.

Credit to William Hay who suggested both this and another possible explanation in a comment to the original question.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.