I have a file which I edit and encrypt following this guide. I'm a noob as far as security goes and thought that the point of including the line which specifies the cryptographic key to use

-*- mode: org -*- -*- epa-file-encrypt-to: ("[email protected]") -*- 

would therefore require me (specified by my email) to enter in my passphrase. However, it seems that I'm doing things wrong as I'm instead doing symmetric encryption instead. I know I'm doing symmetric encryption because I am never prompted for [email protected]'s passphrase. I can list the keys in emacs and my email shows up in the list when I "M-x epa-list-keys"

Can someone point out where I'm going wrong such that I can use my passphrase to encrypt the files? I want to prevent locking myself out by accidentally encrypting the file with a new password, which sadly has happened. :( And from what I've read so far, cracking the file is dang near impossible.

For completeness sake here is my .emacs file

(require 'whitespace)
(setq whitespace-style (quote (spaces tabs newline space-mark tab-mark newline-mark)))

;; EasyPG
(require 'epa)

(defadvice epg--start (around advice-epg-disable-agent disable)
"Make epg--start not able to find a gpg-agent"
(let ((agent (getenv "GPG_AGENT_INFO")))
(setenv "GPG_AGENT_INFO" nil)
(setenv "GPG_AGENT_INFO" agent)))
;;(setenv "GPG_AGENT_INFO" pinentry)))

(defun epg-disable-agent ()
  "Make EasyPG bypass any gpg-agent"
  (ad-enable-advice 'epg--start 'around 'advice-epg-disable-agent)
  (ad-activate 'epg--start)
  (message "EasyPG gpg-agent bypassed"))

(defun epg-enable-agent ()
  "Make EasyPG use a gpg-agent after having been disabled with epg-disable-agent"
  (ad-disable-advice 'epg--start 'around 'advice-epg-disable-agent)
  (ad-activate 'epg--start)
  (message "EasyPG gpg-agent re-enabled"))

;;added to overcome bug in gnupg2 in Arch linux as pointed out here: http://www.emacswiki.org/emacs/EasyPG
(when (file-executable-p "/usr/bin/gpg1")
(setq epg-gpg-program "/usr/bin/gpg1"))
  • I'm assuming that you generated keys? gpg --key-gen
    – schroeder
    Commented Jun 25, 2013 at 21:40
  • 1
    I believe that I was using keys created using ssh-keygen. All three computers have a combination of rsa and/or edcsa keys in .ssh/ Commented Jun 27, 2013 at 15:56
  • 3
    ssh keys != gpg keys. Commented Aug 19, 2013 at 9:38
  • 2
    With public key encryption you don't need a passphrase to encrypt a file only to decrypt it. Your inference that you are using symmetric encryption seems insufficiently evidenced. This seems unlikely to happen by accident. An alternative explanation might be that your attempts to disable gnupg-agent have failed and the agent is caching the key after an earlier use of a password. I would try killing any gpg-agent and then try to read the file in again to verify. Commented Sep 14, 2018 at 20:00
  • 1
    @WilliamHay: Your comment should be an answer. Commented Jan 20, 2019 at 13:50

1 Answer 1


You already seem to be doing public key encryption.

In public key encryption, the data is encrypted with the public key and it is decrypted with the private key. The password is only used to protect the private key. The public key is public for anyone to use, therefore it is normal that you are not requested a password when encrypting.

Credit to William Hay who suggested both this and another possible explanation in a comment to the original question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .