bug#15552: 24.3.50; epa-file-cache-passphrase-for-symmetric-encryption not respected with GnuPG 2.x

[Daiki Ueno]

Stefan Monnier <monnier@iro.umontreal.ca> writes:

>> It used to work like that with gpg1.  However, gpg2's implementation
>> choice is that it does not leak the indication that gpg2 (actually
>> gpg-agent) requires passphrase and it does not allow other tools than
>> pinentry to inject passphrase.
>
> IOW epa-file-cache-passphrase-for-symmetric-encryption only works for
> gpg1 and not for gpg2?

s/works/has no effect/

>> IMO that's a good idea for security (as pinentry uses secmem).
>
> There are many situations where local security is not nearly as
> important as convenience.  But IIUC with gpg2 the general answer is "use
> gpg-agent to do the caching", and it's supposed to work fine (i.e. it's
> just as convenient as caching the password in Emacs).

In this bug report, the reporter intentionally does not set up gpg-agent
for his login session.  Even the GnuPG 2.x manual spends one chapter on
setting up gpg-agent before the chapter on gpg command itself.

>>> Stefan "Also confused about what "symmetric" has to do with it"
>> Perhaps you could try the above recipe under gpg-agent is properly set up:
>> $ echo abc > file
>> $ gpg --symmetric file
>> $ eval `gpg-agent --daemon`
>> $ gpg2 < file.gpg
>> $ gpg2 < file.gpg
>> You won't be asked for the passphrase at the second time, because
>> gpg-agent remembers passphrase based on the file content.
>
> That doesn't really explain to me why
> epa-file-cache-passphrase-for-symmetric-encryption has "symmetric" in
> its name and more specifically why caching of passphrases would be
> different for symmetric than for public key cryptography.

I didn't get the question correctly, then.

Look at the matrix of (info "(epa) Caching Passphrases"), check when a
user is suggested to "set up elisp passphrase cache".

Anyway, the name is not so important to me, as long as it discourages
the use of the variable, so it could be
e.g. epg-file-yo-mama-wears-fancy-glasses-detection-enabled.

https://news.ycombinator.com/item?id=6372466