I'm using doom, working with an encrypted org-journal and keys configured from a yubikey. Opening/decrypting the journal works fine but after entering a new entry and trying to save, epa-file is defaulting to symmetric encryption and asks for a passphrase.

I set "epa-file-select-keys t" to enable the prompt for a key and no recipients are listed when trying to save the journal. What's weird is if i run "M-x epa-file-select-keys" in the same buffer i DO see my key i want to use listed with the email address set in "epa-file-encrypt-to", and once selected there saving works using the key as expected.

Any idea what might be happening here, or how I might go about troubleshooting? epa-file config in config.el:

(use-package! epa-file
  (setq epa-file-encrypt-to '("[email protected]"))
  (epa-file-select-keys t))

Full config.el for doom:

;;; $DOOMDIR/config.el -*- lexical-binding: t; -*-

;; Place your private configuration here! Remember, you do not need to run 'doom
;; sync' after modifying this file!
;; Whenever you reconfigure a package, make sure to wrap your config in an
;; `after!' block, otherwise Doom's defaults may override your settings. E.g.
;;   (after! PACKAGE
;;     (setq x y))
;; The exceptions to this rule:
;;   - Setting file/directory variables (like `org-directory')
;;   - Setting variables which explicitly tell you to set them before their
;;     package is loaded (see 'C-h v VARIABLE' to look up their documentation).
;;   - Setting doom variables (which start with 'doom-' or '+').
;; Here are some additional functions/macros that will help you configure Doom.
;; - `load!' for loading external *.el files relative to this one
;; - `use-package!' for configuring packages
;; - `after!' for running code after a package has loaded
;; - `add-load-path!' for adding directories to the `load-path', relative to
;;   this file. Emacs searches the `load-path' when you load packages with
;;   `require' or `use-package'.
;; - `map!' for binding new keys
;;;; launch maximized
(add-to-list 'default-frame-alist '(left . 0))
(add-to-list 'default-frame-alist '(fullscreen . maximized))
;;;; variables
(setq user-full-name "Randall Torres"
      user-mail-address "[email protected]")
(setq lucky/local-root
      (if (string-equal system-type "windows-nt")
(setq lucky/sync-dir (expand-file-name "onedrive" lucky/local-root))
(setq lucky/org-dir (expand-file-name "org" lucky/sync-dir))
;;;; aesthetics
(setq lucky/font-mono
      (if (string-equal system-type "windows-nt")
          "ShureTechMono NF"
        "ShureTechMono Nerd Font"))
(setq doom-font (font-spec :family lucky/font-mono :size 14)
      doom-big-font (font-spec :family lucky/font-mono :size 18)
      doom-theme 'doom-oksolar-dark)
(setq display-line-numbers-type t)
;;;; org-mode things
(after! org
   org-directory lucky/org-dir
   org-id-locations-file (expand-file-name ".orgids" lucky/org-dir)
   org-id-locations-file-relative t
   org-roam-directory (expand-file-name "roam" lucky/org-dir)
   org-agenda-files (directory-files-recursively lucky/org-dir "\\.org$" t)
   org-todo-keywords `((sequence
                      "LATER(l)" "NOW(n)" "MAYBE(m)" "PROJECT(p)"
                      "DONE(d)" "NOPE(-)"))
   org-fold-catch-invisible-edits 'smart
   org-log-done 'time
   org-log-into-drawer t
   org-log-redeadline 'time
   org-log-reschedule 'time
   org-refile-use-outline-path 'file
   org-use-property-inheritance t
   org-roam-completion-everywhere t))
(use-package! org-journal
  :after org
  (org-journal-dir (concat (file-name-as-directory org-directory) "journal"))
  (org-journal-file-format "%Y/%m/%Y%m%d")
  (org-journal-date-format "%A, %Y-%m-%d")
  (org-journal-encrypt-journal t)
  (org-journal-enable-encryption nil)
  (org-journal-enable-agenda-integration t))
(use-package! ox-extra
  :after org
  (ox-extras-activate '(latex-header-blocks ignore-headlines)))
(use-package! ox-latex
  :after org
  (setq org-latex-pdf-process
        '("pdflatex -interaction nonstopmode -output-directory %o %f"
        "bibtex %b"
        "pdflatex -interaction nonstopmode -output-directory %o %f"
        "pdflatex -interaction nonstopmode -output-directory %o %f"))
  (setq org-latex-hyperref-template nil)
  ;; (setq org-latex-prefer-user-labels t)
  ;; deleted unwanted file extensions after latexMK
  (setq org-latex-logfiles-extensions
        (quote ("lof" "lot" "tex~" "aux" "idx" "log" "out" "toc" "nav" "snm" "vrb" "dvi" "fdb_latexmk" "blg" "brf" "fls" "entoc" "ps" "spl" "bbl" "xmpi" "run.xml" "bcf" "acn" "acr" "alg" "glg" "gls" "ist")))

  (unless (boundp 'org-latex-classes)
    (setq org-latex-classes nil)))
(use-package! epa-file
  (setq epa-file-encrypt-to '("[email protected]"))
  (epa-file-select-keys t))
;; in ~/.doom.d/+bindings.el
(map! :leader
      (:prefix ("j" . "journal") ;; org-journal bindings
        :desc "Create new journal entry" "j" #'org-journal-new-entry
        :desc "Open previous entry" "p" #'org-journal-previous-entry
        :desc "Open next entry" "n" #'org-journal-next-entry
        :desc "Search journal" "s" #'org-journal-search-forever))

;; The built-in calendar mode mappings for org-journal
;; conflict with evil bindings
 (:map calendar-mode-map
   :n "o" #'org-journal-display-entry
   :n "p" #'org-journal-previous-entry
   :n "n" #'org-journal-next-entry
   :n "O" #'org-journal-new-date-entry))

;; Local leader (<SPC m>) bindings for org-journal in calendar-mode
;; I was running out of bindings, and these are used less frequently
;; so it is convenient to have them under the local leader prefix
 :map (calendar-mode-map)
 "w" #'org-journal-search-calendar-week
 "m" #'org-journal-search-calendar-month
 "y" #'org-journal-search-calendar-year)

1 Answer 1


Same behavior in Emacs 27.1 here. It looks like setting epa-file-encrypt-to globally does not work in some cases. For example, after decrypting a file while epa-file-encrypt-to is set globally, epa-file-encrypt-to gets locally set to an all-zero value:

epa-file-encrypt-to is a variable defined in ‘epa-hook.el’.
Its value is ("0000000000000000")
Local in buffer test.gpg; global value is 
("[email protected]")

On the other hand, setting epa-file-encrypt-to as a file-local variable, as recommended in the documentation, works fine:

;; -*- epa-file-encrypt-to: ("[email protected]") -*-

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.