Passphrase caching for GnuPG in Emacs?

Passphrase caching for GnuPG in Emacs?

[Jens Lechtenboerger]

Hi there,

I plan to refactor the code used for GnuPG in the Message mode of
Emacs (Gnus) and started a discussion on the Gnus devel mailing list
ding.  An open issue is passphrase caching within Emacs, which might
be removed in the future.  So if you encrypt e-mail and cache
passphrases inside Emacs (instead of gpg-agent), please let me know
why.  Also, do you think that it is necessary to have four different
variables to enable caching and another four to control caching
duration?  (mml-secure-cache-passphrase, mml1991-cache-passphrase,
mml2015-cache-passphrase, mml-smime-cache-passphrase;
mml-secure-passphrase-cache-expiry, mml1991-passphrase-cache-expiry,
mml2015-passphrase-cache-expiry, mml-smime-passphrase-cache-expiry)

As gpg-agent is the daemon to manage secret keys, I recommend to use
that as trusted place to cache passphrases, which works with GnuPG
1.x. as well as 2.x.  Note that GnuPG 2.x is where the development
happens, and according to GnuPG’s README, “2.0 is the current stable
version for general use”, while “1.4 is the old standalone version
which is most suitable for older or embedded platforms.”

If I’m not mistaken (please let me know if I’m wrong), with GnuPG
2.x (and gpgsm) passphrases cannot be cached within Emacs as
gpg-agent is started automatically and tries to invoke a pinentry
program.  So, caching-related variables only apply to GnuPG 1.x and
S/MIME with openssl (I suggest not to advertise the latter any
longer and will send a separate e-mail to discuss that), which
should be documented if we plan to keep that functionality.

What’s your opinion?

Best wishes
Jens

P.S. Encryption is self-defense.  Learn more:
https://emailselfdefense.fsf.org/

Re: Passphrase caching for GnuPG in Emacs?

[tomas]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, Nov 08, 2015 at 05:00:56PM +0100, Jens Lechtenboerger wrote:
> Hi there,
> 
> I plan to refactor the code used for GnuPG in the Message mode of
> Emacs [...]

> If I’m not mistaken (please let me know if I’m wrong), with GnuPG
> 2.x (and gpgsm) passphrases cannot be cached within Emacs as
> gpg-agent is started automatically and tries to invoke a pinentry
> program.

Just a question: how do you plan to handle this pinentry?

The last time I gave gpg 2 a try, a crude GTK dialog appeared from
nowhere (disrupting my command line workflow). I just ran away,
screaming.

It seems there's a command-line pinentry these days. From Emacs,
my dream would be that it's Emacs which handles user interaction.

Have you any ideas?

thanks
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlZAXTMACgkQBcgs9XrR2kY4DACfZk9kozGfkc5/QUuENtz+rVGx
2B0An3AG4k0MJl0bmBV7PZpYl7R+YOEj
=vhaT
-----END PGP SIGNATURE-----

Re: Passphrase caching for GnuPG in Emacs?

[Stefan Monnier]

> It seems there's a command-line pinentry these days.  From Emacs,
> my dream would be that it's Emacs which handles user interaction.

IIUC with a recent enough Emacs and recent enough GnuPG, Emacs will/can
indeed play the role of "pinentry agent" (so it provides the usual
Emacs UI, and along with that the usual Emacs insecurity of course).


        Stefan

Re: Passphrase caching for GnuPG in Emacs?

[tomas]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, Nov 09, 2015 at 08:47:42AM -0500, Stefan Monnier wrote:
> > It seems there's a command-line pinentry these days.  From Emacs,
> > my dream would be that it's Emacs which handles user interaction.
> 
> IIUC with a recent enough Emacs and recent enough GnuPG, Emacs will/can
> indeed play the role of "pinentry agent" (so it provides the usual
> Emacs UI, and along with that the usual Emacs insecurity of course).

Phew :-)

Thanks
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlZAo3AACgkQBcgs9XrR2kYLTwCfemqJ2toz6PAh8+6ORXe7l84z
zPwAnjDXhrVPQQ6ltR+5o5TltryOIXSZ
=HXXL
-----END PGP SIGNATURE-----

Re: Passphrase caching for GnuPG in Emacs?

[Jens Lechtenboerger]

On 2015-11-09, at 09:45, tomas@tuxteam.de wrote:

> On Sun, Nov 08, 2015 at 05:00:56PM +0100, Jens Lechtenboerger wrote:
>> Hi there,
>>
>> I plan to refactor the code used for GnuPG in the Message mode of
>> Emacs [...]
>
>> If I’m not mistaken (please let me know if I’m wrong), with GnuPG
>> 2.x (and gpgsm) passphrases cannot be cached within Emacs as
>> gpg-agent is started automatically and tries to invoke a pinentry
>> program.
>
> Just a question: how do you plan to handle this pinentry?

Actually, that’s not me, but GnuPG.  And I just realized that I’m
mistaken, pinentry in Emacs is possible but not recommended, see
below.

> The last time I gave gpg 2 a try, a crude GTK dialog appeared from
> nowhere (disrupting my command line workflow). I just ran away,
> screaming.
>
> It seems there's a command-line pinentry these days. From Emacs,
> my dream would be that it's Emacs which handles user interaction.

What you describe is the default for GUIs, I guess.

If I use the option
pinentry-program /usr/local/bin/pinentry-curses
in gpg-agent.conf and start Emacs within a terminal (option -nw),
then the passphrase needs to be entered within the terminal window,
whose contents get replaced by pinentry-curses while entering the
passphrase.  Would that be good enough for you?

Moreover, as mentioned above there is Emacs support in pinentry,
which can be enabled by configure options at compile time.

From the pinentry info pages:
   “Having Emacs get the passphrase is convenient, however, it is a
significant security risk.  Emacs keeps all key presses buffered.  (You
can see the recent key presses by typing 'C-h l' ('view-lossage') in
emacs.)  Further, Emacs is a huge program, which doesn't provide any
process isolation to speak of.  As such, having it handle the passphrase
adds a huge chunk of code to the user's trusted computing base.  Because
of this concern, Emacs doesn't enable this by default (the user has to
run '(pinentry-start)', e.g., from his or her '.emacs' file,
explicitly).”

Out of curiosity: Are you customizing any of the 8 variables related
to passphrase caching that I mentioned in my earlier message?

Best wishes
Jens

_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Passphrase caching for GnuPG in Emacs?

[tomas]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, Nov 09, 2015 at 02:55:40PM +0100, Jens Lechtenboerger wrote:
> On 2015-11-09, at 09:45, tomas@tuxteam.de wrote:
> 
> > On Sun, Nov 08, 2015 at 05:00:56PM +0100, Jens Lechtenboerger wrote:
> >> Hi there,
> >>
> >> I plan to refactor the code used for GnuPG in the Message mode of
> >> Emacs [...]

> > The last time I gave gpg 2 a try, a crude GTK dialog appeared from
> > nowhere (disrupting my command line workflow). I just ran away,
> > screaming.
> >
> > It seems there's a command-line pinentry these days. From Emacs,
> > my dream would be that it's Emacs which handles user interaction.
> 
> What you describe is the default for GUIs, I guess.

yes, I suppose.

> If I use the option
> pinentry-program /usr/local/bin/pinentry-curses
> in gpg-agent.conf and start Emacs within a terminal (option -nw),
> then the passphrase needs to be entered within the terminal window,
> whose contents get replaced by pinentry-curses while entering the
> passphrase.  Would that be good enough for you?

That would force me to use Emacs -nw. Hmmm.

> Moreover, as mentioned above there is Emacs support in pinentry,
> which can be enabled by configure options at compile time.

Yep, that'll be it. I'm aware of the risks[1], I'll take them. Thanks
for pointing me to a solution.

> >From the pinentry info pages:
>    “Having Emacs get the passphrase is convenient, however, it is a
> significant security risk [...]

> Out of curiosity: Are you customizing any of the 8 variables related
> to passphrase caching that I mentioned in my earlier message?

No. Your changes won't affect me. My question was on a tangent anyway,
but thanks for the clarifications.

[1] If someone takes over my Emacs I'm SOL anyway. All my data go down
in flames :-)

Regards
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlZApJ4ACgkQBcgs9XrR2kZ73gCfbwJpAAdMrzdRCartF9kL3FNK
ANoAmwVTM18AhtjlUWFWmTzSIpJIoibO
=NOky
-----END PGP SIGNATURE-----

Re: Passphrase caching for GnuPG in Emacs?

[Kevin Brubeck Unhammer]

[-- Attachment #1.1: Type: text/plain, Size: 1632 bytes --]

Jens Lechtenboerger <jens.lechtenboerger@fsfe.org> writes:

[...]

> If I use the option
> pinentry-program /usr/local/bin/pinentry-curses
> in gpg-agent.conf and start Emacs within a terminal (option -nw),
> then the passphrase needs to be entered within the terminal window,
> whose contents get replaced by pinentry-curses while entering the
> passphrase.  Would that be good enough for you?

Because of the pinentry issues in gpg2, I have so far kept gpg1
installed as well, and used that instead of agent/pinentry-gtk iff I'm
in a text terminal. If I'm being graphical, I don't mind the gtk entry,
since it 1) works and 2) caches things, presumably securely.

(defadvice epg--start (around advice-epg-disable-agent activate)
  "Don't allow epg--start to use gpg-agent in plain text
terminals."
  (if (display-graphic-p)
      ad-do-it
    (let ((agent (getenv "GPG_AGENT_INFO")))
      (setenv "GPG_AGENT_INFO" nil) ; give us a usable text password prompt
      ad-do-it
      (setenv "GPG_AGENT_INFO" agent))))

(defadvice epg-make-context (around advice-epg-gpg1 activate)
  "Don't allow epg-make-context to use gpg2 in plain text
terminals."
  (if (display-graphic-p)
      ad-do-it
    (let ((gpg epg-gpg-program))
      (setq epg-gpg-program "/usr/bin/gpg1")
      ad-do-it
      (setq epg-gpg-program gpg))))


Can the pinentry-program setting be changed on-the-fly so I can say
"give me the gtk one" or "give me the curses one" depending on
(display-graphic-p) ?


Also, AFAIK, I don't use any of the mm-cache-variables.




-- 
Kevin Brubeck Unhammer

GPG: 0x766AC60C

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 472 bytes --]

Re: Passphrase caching for GnuPG in Emacs?

[Jens Lechtenboerger]

On 2015-11-11, at 09:15, Kevin Brubeck Unhammer wrote:

> Can the pinentry-program setting be changed on-the-fly so I can say
> "give me the gtk one" or "give me the curses one" depending on
> (display-graphic-p) ?

I don’t know about that.  However, /usr/bin/pinentry-gtk-2 falls
back to curses in a “real” terminal.

I realize that I may have misunderstood tomás, and I’m also not sure
about your use cases: In a “GUI terminal” (say, xterm),
pinentry-gtk-2 pops up a window, whereas it uses that terminal if
there is no GUI.

Best wishes
Jens

_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Passphrase caching for GnuPG in Emacs?

[Kevin Brubeck Unhammer]

[-- Attachment #1.1: Type: text/plain, Size: 880 bytes --]

Jens Lechtenboerger <jens.lechtenboerger@fsfe.org> writes:

> On 2015-11-11, at 09:15, Kevin Brubeck Unhammer wrote:
>
>> Can the pinentry-program setting be changed on-the-fly so I can say
>> "give me the gtk one" or "give me the curses one" depending on
>> (display-graphic-p) ?
>
> I don’t know about that.  However, /usr/bin/pinentry-gtk-2 falls
> back to curses in a “real” terminal.
>
> I realize that I may have misunderstood tomás, and I’m also not sure
> about your use cases: In a “GUI terminal” (say, xterm),
> pinentry-gtk-2 pops up a window, whereas it uses that terminal if
> there is no GUI.

I had a problem where if I did ssh without -X, I wouldn't be able to
type into the pinentry from Emacs. I suppose I should try again with the
newest gnupg2 to see if that is still an issue.

-- 
Kevin Brubeck Unhammer

GPG: 0x766AC60C

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 472 bytes --]

Re: Passphrase caching for GnuPG in Emacs?

[Greg Bell]

Note to everybody trying to get this to work - I noticed that passphrases
entered into pinentry-curses (0.8.3) don't get cached by gpg-agent for some
reason.  Using pinentry-gtk or pinentry-curses, they do.  Weird, I know.

I didn't want you to pull your hair out trying to figure that out, since
I've already done that for all of us :)

Re: Passphrase caching for GnuPG in Emacs?

[Peter Münster]

On Tue, Dec 22 2015, Greg Bell wrote:

> Note to everybody trying to get this to work - I noticed that passphrases
> entered into pinentry-curses (0.8.3) don't get cached by gpg-agent for some
> reason.  Using pinentry-gtk or pinentry-curses, they do.  Weird, I know.

There is also this nice tool: /usr/lib64/gpg-preset-passphrase

-- 
           Peter

Re: Passphrase caching for GnuPG in Emacs?

[Teemu Likonen]

[-- Attachment #1.1: Type: text/plain, Size: 854 bytes --]

Jens Lechtenboerger [2015-11-08 17:00:56+01] wrote:

> I plan to refactor the code used for GnuPG in the Message mode of
> Emacs (Gnus) and started a discussion on the Gnus devel mailing list
> ding. An open issue is passphrase caching within Emacs, which might be
> removed in the future.

I'd like to move pretty much all password caching outside Emacs so I'm
fine with such plans. Do your plans include mail-source-password-cache
too?

For example, in my system Gnus's mail-sources variable is set to fetch
mail from a server. The password is stored in ~/.authinfo.gpg but then
stored in mail-source-password-cache variable:

    (("server:login:nil" . "password"))

I'd like to get rid of that too.

-- 
/// Teemu Likonen   - .-..   <https://github.com/tlikonen> //
// PGP: 4E10 55DC 84E9 DFF6 13D7 8557 719D 69D3 2453 9450 ///

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]

Re: Passphrase caching for GnuPG in Emacs?

[Jens Lechtenboerger]

On 2016-01-05, at 17:40, Teemu Likonen wrote:

> Jens Lechtenboerger [2015-11-08 17:00:56+01] wrote:
>
>> I plan to refactor the code used for GnuPG in the Message mode of
>> Emacs (Gnus) and started a discussion on the Gnus devel mailing list
>> ding. An open issue is passphrase caching within Emacs, which might be
>> removed in the future.
>
> I'd like to move pretty much all password caching outside Emacs so I'm
> fine with such plans. Do your plans include mail-source-password-cache
> too?

No, I was just referring to GnuPG passphrases.

> For example, in my system Gnus's mail-sources variable is set to fetch
> mail from a server. The password is stored in ~/.authinfo.gpg but then
> stored in mail-source-password-cache variable:
>
>     (("server:login:nil" . "password"))
>
> I'd like to get rid of that too.

I wasn’t aware of this, and I don’t like that either.

Best wishes
Jens

_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

Re: Passphrase caching for GnuPG in Emacs?

[Jude DaShiell]

packages that are smart enough can always use .netrc and source that for 
credentials and that has been around since ftp got created.

On Tue, 5 Jan 2016, Jens Lechtenboerger wrote:

> Date: Tue, 5 Jan 2016 10:58:06
> From: Jens Lechtenboerger <jens.lechtenboerger@fsfe.org>
> To: Teemu Likonen <tlikonen@iki.fi>
> Cc: help-gnu-emacs@gnu.org, info-gnus-english@gnu.org
> Subject: Re: Passphrase caching for GnuPG in Emacs?
> 
> On 2016-01-05, at 17:40, Teemu Likonen wrote:
>
>> Jens Lechtenboerger [2015-11-08 17:00:56+01] wrote:
>>
>>> I plan to refactor the code used for GnuPG in the Message mode of
>>> Emacs (Gnus) and started a discussion on the Gnus devel mailing list
>>> ding. An open issue is passphrase caching within Emacs, which might be
>>> removed in the future.
>>
>> I'd like to move pretty much all password caching outside Emacs so I'm
>> fine with such plans. Do your plans include mail-source-password-cache
>> too?
>
> No, I was just referring to GnuPG passphrases.
>
>> For example, in my system Gnus's mail-sources variable is set to fetch
>> mail from a server. The password is stored in ~/.authinfo.gpg but then
>> stored in mail-source-password-cache variable:
>>
>>     (("server:login:nil" . "password"))
>>
>> I'd like to get rid of that too.
>
> I wasn?t aware of this, and I don?t like that either.
>
> Best wishes
> Jens
>
>

-- 

Re: Passphrase caching for GnuPG in Emacs?

[Teemu Likonen]

[-- Attachment #1: Type: text/plain, Size: 547 bytes --]

Jude DaShiell [2016-01-05 13:16:23-05] wrote:

> packages that are smart enough can always use .netrc and source that
> for credentials and that has been around since ftp got created.

But my point was that mail-source knows how to use secure
~/.authinfo.gpg storage. It reads the password from there and then
stores it to mail-source-password-cache variable as clear text and the
passwords never expire.

-- 
/// Teemu Likonen   - .-..   <https://github.com/tlikonen> //
// PGP: 4E10 55DC 84E9 DFF6 13D7 8557 719D 69D3 2453 9450 ///

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]