Potential bug:
- Case 1: gpg2 fails to find secret key when content encrypted with "throw-keyids" option in gpg.conf file.
- "gpg: decryption failed: No secret key"
- Case 2: gpg2 succeeds with "# throw-keyids" in gpg.conf file.
- gpg succeeds in both Case 1 and 2.
Example:
- Encrypt clearfilename to cipherfilename with "throw-keyids" option ON, gpg can decrypt but gpg2 fails
[gpg.conf]
...
throw-keyids
...
$ gpg2 --recipient 0xKEYID --output cipherfilename.throw-keyids --encrypt clearfilename $ gpg --verbose --decrypt cipherfilename.throw-keyids gpg: public key is 0x00000000 gpg: anonymous recipient; trying secret key 0xKEYID001 gpg: using subkey 0xsubKEY001 instead of primary key 0xKEYID001 [pinentry-gtk-2] Enter passphrase: ... 0xKEYID002 ... 0xsubKEYID002 gpg: anonymous recipient; trying secret key 0xKEYID gpg: anonymous recipient; trying secret key 0xsubKEYID gpg: okay, we are the anonymous recipient. gpg: encrypted with RSA key, ID 0x00000000 gpg: AES256 encrypted data gpg: original file name='clearfilename' [contents of clearfilename successfully output to terminal] $ gpg2 --verbose --decrypt cipherfilename.throw-keyids gpg: public key is 0x00000000 gpg: encrypted with RSA key, ID 0x00000000 gpg: decryption failed: No secret key
- Encrypt clearfilename to cipherfilename with "throw-keyids" option OFF, gpg AND gpg2 can decrypt
[gpg.conf]
...
##### throw-keyids
...
$ gpg2 --recipient 0xKEYID --output cipherfilename.throw-keyids.OFF --encrypt clearfilename $ gpg --verbose --decrypt cipherfilename.throw-keyids.OFF gpg: public key is 0xsubKEYID gpg: using subkey 0xsubKEYID instead of primary key 0xKEYID You need a passphrase to unlock the secret key for user: "name <email>" gpg: using subkey 0xsubKEYID instead of primary key 0xKEYID 4096-bit RSA key, ID 0xsubKEYID, created [past] (subkey on main key ID 0xKEYID) gpg: encrypted with 4096-bit RSA key, ID 0xsubKEYID, created [past] "name <email>" gpg: AES256 encrypted data gpg: original file name='clearfilename' [contents of clearfilename successfully output to terminal] $ gpg2 --verbose --decrypt cipherfilename.throw-keyids.OFF gpg: public key is 0xKEYID gpg: using subkey 0xsubKEYID instead of primary key 0xKEYID gpg: using subkey 0xsubKEYID instead of primary key 0xKEYID [yes, duplicate] gpg: encrypted with 4096-bit RSA key, ID 0xsubKEYID, created [past] "name <email>" gpg: AES256 encrypted data gpg: original file name='clearfilename' [contents of clearfilename successfully output to terminal]
What can I do to help gpg2 find the secret key when sender uses throw-keyids option in their gpg.conf file? Or even ask for a passphrase?