1

I recently setup org-crypt to use my gpg key to encrypt headings in org-mode files. I post my .init files in a public github repo.

My question is: Is the key in (setq org-crypt-key "xxxxxxxx") actually my gpg secret key?

Did I just post my gpg secret key online?

I'm revoking the key, generating a new one, then encrypting that heading in my .init file just to be safe.

1

org-crypt-key is the GPG key identifier, normally an email address.

Your GPG secret key resides in the secret ring in your .gnupg directory, and is protected by your passphrase.

From the source code comments:

;; 2. Set the encryption key to use in the `org-crypt-key' variable,
;;    or use `M-x org-set-property' to set the property CRYPTKEY to
;;    any address in your public keyring.  The text of the entry (but
;;    not its properties or headline) will be encrypted for this user.
;;    For them to read it, the corresponding secret key must be
;;    located in the secret key ring of the account where you try to
;;    decrypt it.  This makes it possible to leave secure notes that
;;    only the intended recipient can read in a shared-org-mode-files
;;    scenario.
;;    If the key is not set, org-crypt will default to symmetric encryption.
| improve this answer | |
  • Thank you for responding Juancho. For (setq org-crypt-key ) I entered the 8 digit ID of my key instead of an email address. I'm having trouble understanding if the 8 digit number that identifies the key is "secret" or not. Example: gpg --list-keys show a line for pub, uid, and ssb. I used the 8 digit number shown as ssb 4096R/XXXXXXXX. Is this 8 digit number secret? – SeaDude Nov 12 '17 at 5:09
  • 1
    That is just a key identification number. There is nothing there from your private key. – Juancho Nov 12 '17 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.