[Solved] Gpg can’t decrypt: invalid cipher mode

cr0wbar · n00b Joined: 27 Oct 2021 Posts: 7

Can’t use

mike155 · Posted: Wed Oct 27, 2021 1:45 pm Post subject:

Hi cr0wbar,

welcome to the Gentoo forums!

I completely fail to understand your post. A command "pass" doesn't exist on my Gentoo machine. And why do you want to encrypt passwords? Please tell us what you want to achieve and show us the commands you use. Please post the output of "emerge --info app-crypt/gnupg".

Mike

Hu · Administrator Joined: 06 Mar 2007 Posts: 23193

This might be from app-admin/pass, which, as I understand it, is a wrapper around using gnupg to maintain encrypted text files, where the decrypted contents are your usernames+passwords for various services. mike155's requests look like a good start to me.

mike155 · Posted: Wed Oct 27, 2021 4:03 pm Post subject:

@Hu: thanks, now it starts to make sense :-)

The homepage explains how it works:

mike155 · Posted: Wed Oct 27, 2021 4:34 pm Post subject:

Do I understand correctly that "pass show" works for some passwords and that it does not work for some other passwords?

Please chdir to your password store directory and analyze the encrypted password files with 'file':

Code:

# cd ~/.password-store
# file ./Amazon/amazonemail@email.com.gpg
./Amazon/amazonemail@email.com.gpg: PGP RSA encrypted session key - keyid: FC2C3F85 4F5692B7 RSA (Encrypt or Sign) 4096b .

Is there a difference in the encryption format (in the example above: 'PGP RSA encrypted session key 4096b') between the key files that work and those that don't work?

You wrote that the issue started when you created a new key? Please run

Code:

gpg --list-public-keys

The command will show your keys and also their algorithms ('rsa4096' for example). Is there a difference in the algorithm between your old key and your new key?

cr0wbar · n00b Joined: 27 Oct 2021 Posts: 7

Apologies, I should have provided more context.
Yeah pass is a gpg wrapper for storing passwords in separate files encrypted with gpg. The idea is that the files where the passwords are stored are hosted on a private repo to keep them synced across different places, and are stored safely because they are encrypted with gpg. It is possible to decrypt and reencrypt all the files where the password are stored with a single command "pass init <new_key_id>", which will decrypt all the files, and reencrypt their content with the new key.

I have a mac, with gnupg 2.3.2 and libgcrypt 1.9.4, where I have reincrypted the passwords, going from a rsa2048 key to a rsa4096 key.
I can decrypt the keys just fine on the mac.

However, on gentoo with gnupg 2.2.32 and libgcrypt 1.8.8 I can decrypt files that were originally encrypted with the rsa2048 key and reencrypted with the new rsa4096 one, but cannot decrypt new files encrypted only with the new rsa4096 key, which is odd. This is the error i get

cr0wbar · n00b Joined: 27 Oct 2021 Posts: 7

solved by adding

Hu · Administrator Joined: 06 Mar 2007 Posts: 23193

The newer version of libgcrypt probably offers, and your Mac used, a cipher that does not work in the v1.8.x line.

You could change your accept_keywords entry to be version-locked, so that it enables you to use the testing version that works, but does not bring you ever newer testing versions.

mike155 · Posted: Wed Oct 27, 2021 7:55 pm Post subject:

cr0wbar · n00b Joined: 27 Oct 2021 Posts: 7

That’s great advice, I am still learning about gentoo and that really helps. Thank you guys!