How to use gpg command line to check passphrase

Question

I try to automate the backup using duplicity , but when I test the result, I get

gpg: public key encryption failure: bad passphrase

I want to check if the passphrase that I use is actually a passphrase associated with the corresponding gpg private key, but I can’t see in the gpg command line options: "Do not encrypt or decrypt anything Just confirm that I am using the correct passphrase. "

This suggests that maybe I (once again) misunderstand the Gnu Privacy Guard. (He tends to scoff at me until I cry.)

Does it make sense to ask gpg to check the passphrase? If so, how?

Answer 1

There is no built-in method, but just creating a test that does not modify anything and allows you to simply check your phrase.

You did not specify, so suppose you are using a version of GnuPG less than v2, and are on Linux with Bash for your command line interpreter.

I will give a command here and below, I will explain what each part does (note: for the GnuPG series version 1, see below for the GnuPG v2 series)

echo "1234" | gpg --no-use-agent -o /dev/null --local-user <KEYID> -as - && echo "The correct passphrase was entered for this key"

What does this mean, first transfer some text to GnuPG using echo "1234" | - because we really do not want to sign anything, this is just a test, so we will sign some kind of useless text.

Then we say that gpg does not use the key agent with --no-use-agent ; this is important later because, depending on your key agent, it cannot return “0” for success, and that’s all we want to do is check the success of your phrase.

Then we tell gpg to put the signed data directly in the /dev/null file, that is, we discard it and do not write the result to the terminal. NOTE. If you are not using any version of Linux / Unix, this file may not exist. In windows, you may need to simply allow written data to be written to the screen by simply omitting the -o /dev/null .

Then we will specify the key that we want to execute using --local-user 012345 . You can use KeyID for maximum specificity or use a username, whichever suits your needs best.

Next, we will specify -as , which enables the ascii output mode, and sets the context mode for signing. After that - simply tells GnuPG that the data is signed from standard input, which is the very first part of the command that we gave echo "1234" | .

And finally, we have && echo "A message that indicates success" - "& &" means that if the previous command was successful, print this message. This is simply added for clarity, because the success of the team above would otherwise be indicated by a lack of output.

I hope this is clear enough for you to understand what is happening and how you can use it to conduct the testing that you want to do. If any part is unclear or you do not understand, I will be happy to clarify. Good luck

[EDIT] - If you are using GnuPG v2, the above command needs to be slightly modified, for example:

echo "1234" | gpg2 --batch --passphrase-fd 1 -o /dev/null --local-user <KEYID> -as - && echo "The correct passphrase was entered for this key"

The reason is that GnuPG v2 expects the passphrase to be received through the agent, so we cannot disable the use of the agent with --no-use-agent and have the desired effect; instead, we need to tell GnuPG v2 that we want to start the "batch" process and get the passphrase from STDIN (standard in) using the --passphrase-fd 1 option.

Answer 2

Shorter cmdline for validating passphrases

gpg --export-secret-keys -a> / dev / null && echo OK

Answer 3

Just set your private key passphrase to "" (blank). This will allow you not to declare the passphrase argument on the command line without getting a phrase hint.

your command line for a single file should look like this:

 gpg -d file_to_decrypt.pgp 

or for several files:

 gpg -- batch --decrypt-files *.pgp 

Note. To change the passphrase, you can either execute it through the command line or using a graphical interface such as Kleopatra or GPA (recommended).