Page MenuHome GnuPG
Create Task
Maniphest T4997

2.2.21 breaks passphrase-repeat and password checking
Closed, ResolvedPublic
Actions

Description

On macOS 10.14.6 here.

I just built gpg 2.2.21. To my surprise, when I symmetrically encrypt a file I am now hounded by pinentry about (a) the length of my passphrase, (b) how many special characters are in my passphrase. Also, (c) it demands that I enter the passphrase again even though passphrase-repeat 0 is in my gpg.conf.

It seems to me that (c) must be a bug. passphrase-repeat 0 has been in my gpg.conf for at least 8 years and I have never experienced this nag before.

I could workaround (a) and (b) my appending settings for min-passphrase-len and min-passphrase-nonalpha. But since (as far as I can tell) there is no mention of any changes regarding passphrase requirements in the release notes, I suspect that this might be a bug too.

Revisions and Commits

rG GnuPG
rGa4d73b1c8e2a gpg: Fix regression for non-default --passphrase-repeat option.
rGb8c4dd902df3 gpg: Fix regression for non-default --passphrase-repeat option.

Related Objects
Search...

Event Timeline

chdiza created this task.Jul 16 2020, 10:02 PM
chdiza created this object in space S1 Public.
• werner triaged this task as Normal priority.Jul 17 2020, 10:32 AM
• werner added projects: gnupg (gpg22), Bug Report.
• werner added a subscriber: • werner.

Right 2.2.21 fixes a long standing bug in symmetric encryption in that the configured passphrase constraints were not checked. Eventually we will add a second sec of constraints here but for now the same constrains as for private key protection are used.

Do you configured gpg so that you did not get a passphrase confirmation? If so, is that a real world use case? The odds for a typo in a hidden field are quite high and thus the recipient would run into trouble. Better be sure about the passphrase when sending. But well you decision.

I have not checked the code yet but it is likely that I introduced such a bug.

• werner claimed this task.Jul 17 2020, 10:33 AM
• werner added a parent task: T4897: Release GnuPG 2.2.21.
chdiza added a comment.Jul 17 2020, 3:52 PM

Do you configured gpg so that you did not get a passphrase confirmation?

I have a gpg.conf that consists of a single line: passphrase-repeat 0. Until I had to append some settings to disable the nagging about password characteristics, I had a gpg-agent conf that consisted of two lines: one that sets default-cache-ttl and one that sets pinentry-program.

If so, is that a real world use case?

Yes. I encrypt local files only for myself, not for transmission to others. I have the passwords in deep muscle-memory; thus if I make a typo while setting a password there are a manageably small number of ways in which I might have done it wrong.

chdiza added a comment.Jul 17 2020, 3:54 PM

Here is another thing worth reporting. I found that passphrase-repeat is entirely ignored, regardless of the value set.

E.g., I set it to 4 and tried to symmetrically encrypt a file. I expected it to ask for the passphrase four times, but it only asked twice. So it isn't just my nonstandard setting of 0 that isn't working.

• werner added a commit: rGb8c4dd902df3: gpg: Fix regression for non-default --passphrase-repeat option..Aug 20 2020, 9:35 AM
• werner added a commit: rGa4d73b1c8e2a: gpg: Fix regression for non-default --passphrase-repeat option..Aug 20 2020, 9:40 AM
• werner closed this task as Resolved.Aug 20 2020, 9:43 AM

Thanks for reporting. Fixed for 2.2.22. repeat==0 works like before and repeat>1 also (that is several passphrase pinentries will pop up).