2

I recently setup org-crypt to use my gpg key to encrypt headings in org-mode files. I post my .init files in a public github repo.

My question is: Is the key in (setq org-crypt-key "xxxxxxxx") actually my gpg secret key?

Did I just post my gpg secret key online?

I'm revoking the key, generating a new one, then encrypting that heading in my .init file just to be safe.

1 Answer 1

2

org-crypt-key is the GPG key identifier, normally an email address.

Your GPG secret key resides in the secret ring in your .gnupg directory, and is protected by your passphrase.

From the source code comments:

;; 2. Set the encryption key to use in the `org-crypt-key' variable,
;;    or use `M-x org-set-property' to set the property CRYPTKEY to
;;    any address in your public keyring.  The text of the entry (but
;;    not its properties or headline) will be encrypted for this user.
;;    For them to read it, the corresponding secret key must be
;;    located in the secret key ring of the account where you try to
;;    decrypt it.  This makes it possible to leave secure notes that
;;    only the intended recipient can read in a shared-org-mode-files
;;    scenario.
;;    If the key is not set, org-crypt will default to symmetric encryption.
3
  • Thank you for responding Juancho. For (setq org-crypt-key ) I entered the 8 digit ID of my key instead of an email address. I'm having trouble understanding if the 8 digit number that identifies the key is "secret" or not. Example: gpg --list-keys show a line for pub, uid, and ssb. I used the 8 digit number shown as ssb 4096R/XXXXXXXX. Is this 8 digit number secret?
    – SeaDude
    Nov 12, 2017 at 5:09
  • 1
    That is just a key identification number. There is nothing there from your private key.
    – Juancho
    Nov 12, 2017 at 14:37
  • Can you add an example of using CRYPTKEY? It doesn't seem to work for me; I have added the property both to the encrypted header and to its parent.
    – HappyFace
    May 30, 2021 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.