4

Is mandatory to use pinentry with gpg2?

Why is pinentry better over legacy prompt?

Sari
  • 53
  • 3
sebelk
  • 4,209
  • 10
  • 35
  • 54
  • I've found that in Fedora 22 does not use pinentry when asking for the passphrase, but it does use it on CentOS 6. Anyway if I run repoquery --whatrequires pinentry on both, it tells that gnupg2 requires pinentry. I still don't understand. – sebelk Sep 11 '15 at 22:23
  • On Fedora, pinentry didn't appear because, gpg calls to v1, if I run gpg2 then it launches pinentry-gtk. Anyway I still don't know if pinentry is better or more secure than legacy passphrase prompt. – sebelk Sep 15 '15 at 20:37
  • isn't `pinentry-tty` (executable file that can be symlinked to pientry for being the default implementation) is the legacy prompt? :-) –  May 22 '18 at 11:25

1 Answers1

3

Yes, the use of a pinentry program is mandatory with GnuPG 2 and later.

This follows from the updated architecture in use nowadays:

  • GnuPG clients no longer deal with private key material, or with passphrases etc. (as far as possible — as far as I can tell, the only time a passphrase goes through the client is when you change it);
  • to support this, a separate process, the agent, stores private keys; it runs as a user-level daemon, started automatically when a client needs it;
  • the agent, being a daemon, doesn’t have an “owning” terminal, nor does it know how to obtain input from the user;
  • obtaining input from the user is delegated to a pinentry-compatible program of the user’s choice.

The use of a pinentry program ensures that your private key stays confined to the agent (if it knows about it at all of course), without your having to supply the private key and passphrase explicitly to the agent (as happens e.g. with ssh-add). It also ensures that the requests for your passphrase are consistent, regardless of the source of the request (the amount of security that that provides is as usual up for debate).

Stephen Kitt
  • 411,918
  • 54
  • 1,065
  • 1,164