I'm trying to use password-store as password manager under linux. I created a private github repo with my gpg files in order to use it with other devices. I installed android-password-store app for this end, which uses openkeychain as a openpgp client.(openkeychain paper).

My concern is that isn't using an private-public model (asymmetric crypto), you have to export your private key of your gnupg keyring and import it into your openkeychain keyring. I don't feel very safe exporting my private key when the public key exchange is a very good solution. What do you think about?

Thanks in advance.

  • $\begingroup$ The phrase starting in "My concern" is not intelligible. Is the concern that: in order to use a private key on multiple machines, it has to be exported? That seems just as inevitable as a having to travel in order to get to another place. Yes there is an associated rick, but we have to cope with it. In GnuPG/PGP, that solved with a passphrase, or a Smart Card. $\endgroup$ – fgrieu Sep 2 '20 at 15:16

It took me a bit to understand your issue. In summary, you want to use your passwordstore password manager on multiple devices, without copying the private pgp keys to multiple devices.

Yes, it can be done. You need to create a separate key for each device, and configure your store to encrypt the passwords to multiple keys.

If you follow the steps at https://www.passwordstore.org/ it is mentioned at Setting it up:

pass init "ZX2C4 Password Storage Key"

ZX2C4 Password Storage Key is the ID of my GPG key. You can use your standard GPG key or use an alternative one especially for the password store as shown above. Multiple GPG keys can be specified, for using pass in a team setting, and different folders can have different GPG keys, by using -p.

The man page details how it is used: you need to list the multiple keys on the .gpg-id file, one per line.

Each or your devices will need to have the public keys of all of the devices imported, so that they are able to encrypt the files for 'everyone'.

  • $\begingroup$ Thanks for the answer! One doubt, my keyring is already configured using one private key, could I add more keys for the password encryption or I have to create one from scratch? $\endgroup$ – dlag Sep 27 '20 at 19:51
  • $\begingroup$ You can add more keys, but already existing entries will have to be re-encrypted in order to be readable by the other key. $\endgroup$ – Ángel Sep 28 '20 at 0:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.