[pass] Allow multiple GPG keys

[Matthew Cengia]

Hi all,

Attached is a patch that allows you to encrypt your password store with
multiple GPG keys, such as in the case where you wanted to allow work
colleagues to access your passwords for customer systems, or allow your
partner access to your passwords in case of an emergency.

[Brian Shore]

Post by Matthew Cengia
Attached is a patch that allows you to encrypt your password store with
multiple GPG keys, such as in the case where you wanted to allow work
colleagues to access your passwords for customer systems, or allow your
partner access to your passwords in case of an emergency.

Hi,
I can already do this by defining a group in gpg.conf, e.g.

group pass=0x12345678 0x23456789 ...

What is gained by adding this functionality directly to pass?

[Matthew Cengia]

On 2014-02-11 15:28, Brian Shore wrote:
[...]

Post by Brian Shore
Hi,
I can already do this by defining a group in gpg.conf, e.g.
group pass=0x12345678 0x23456789 ...
What is gained by adding this functionality directly to pass?

Uh. Nothing. I think I read about the gpg.conf group directive long ago
but had forgotten about it.

You're absolutely right, gpg.conf is almost certainly the correct place
to specify this.

[Daniel Motles]

I find the GPG groups mechanism slightly cumbersome, especially if you
want to add a new key to the group. It seems non intuitive.
Documentation on the project website with how to use GPG groups to
manage multiple keys would be great. Alternatively, a mechanism in
pass to set this up for you (or maybe even a separate
command/program!) would be nice.

The reason I am critiquing this is my anecdotal experience with trying
to set this up myself. I was using git to sync my password-store
across devices and I exported the public keys of all the devices to
each other device. I also added the group config to each one. Yet it
happened that some devices were not able to decrypt passwords created
by others. I don't know why as the configuration was identical on
each. :(

I haven't gone back to figure out what was wrong due to lack of time.
Now I just sync a key pair on my local network using gpg --export |
ssh 'gpg --import' type commands. This works phenomenally but is
generally frowned upon security wise to export the private key, and I
might run into issues later if I want to change the key.

Dan

Post by Matthew Cengia
[...]

Post by Brian Shore
Hi,
I can already do this by defining a group in gpg.conf, e.g.
group pass=0x12345678 0x23456789 ...
What is gained by adding this functionality directly to pass?

Uh. Nothing. I think I read about the gpg.conf group directive long ago
but had forgotten about it.
You're absolutely right, gpg.conf is almost certainly the correct place
to specify this.
--
Regards,
Matthew Cengia
_______________________________________________
Password-Store mailing list
http://lists.zx2c4.com/mailman/listinfo/password-store

[Michael Howe]

Hello,

Post by Brian Shore

Post by Matthew Cengia
Attached is a patch that allows you to encrypt your password store with
multiple GPG keys, such as in the case where you wanted to allow work
colleagues to access your passwords for customer systems, or allow your
partner access to your passwords in case of an emergency.

Hi,
I can already do this by defining a group in gpg.conf, e.g.
group pass=0x12345678 0x23456789 ...
What is gained by adding this functionality directly to pass?

Having it managed by git. The obvious use-case here being for shared
password storage for a team, where you want to ensure that adding a new
key (or removing an old one) means everyone's config is updated
automatically. Relying on individuals to update their gpg.conf files
manually in that situation is going to go wrong sooner or later.

Best wishes,

Michael

[Jason A. Donenfeld]

Post by Michael Howe
Having it managed by git. The obvious use-case here being for shared
password storage for a team, where you want to ensure that adding a new
key (or removing an old one) means everyone's config is updated
automatically. Relying on individuals to update their gpg.conf files
manually in that situation is going to go wrong sooner or later.

This paragraph convinced me, whereas many similar paragraphs in the
past did not.

http://git.zx2c4.com/password-store/commit/?id=b1314982194c99361c2b81b3359a21d5a289fdb5

This will be out with the next release. Thanks for the nudge.