I'm using Emacs 26.1 and GnuPG 2.1.18. The help doc for variable epa-file-cache-passphrase-for-symmetric-encryption explains that enabling this option is a security risk and to "consider using gpg-agent which does the same job in a safer way."

However, it does not seem that passphrases cached by gpg-agent are ever used for encryption, only for decryption. (I always get a passphrase prompt when saving a .gpg file, even if I was able to automatically open/decrypt the file using a cached passphrase.) Conversely, setting epa-file-cache-passphrase-for-symmetric-encryption to t allows EPA to cache passphrases for both decryption and encryption.

Therefore, it seems to me that the statement that gpg-agent "does the same job in a safer way" is incorrect. Am I mistaken that gpg-agent can only be used to cache passphrases for decryption (when using symmetric encryption)? Or are the docs wrong? (Also see How to get gpg-agent to cache the passphrases I enter when reading/saving *.gpg files?)

Additionally, the user's manual asserts that you cannot use the elisp passphrase cache with GnuPG 2.1 or 2.0, but I am doing so just fine (by enabling epa-file-cache-passphrase-for-symmetric-encryption). Does this change in Emacs >26.1, or is it another mistake in the docs?

If these are legitimate errors in the docs, then I will file a bug report for EPA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.