I have started using pass a year ago. Made a gpg key pair and followed some tutorial to set it up and everything worked great. A few days ago my gpg key expired and pass doesn't allow me to use it now. I have deleted the original key, generated a new one, passed it as an argument in "pass init" but got an error with every single password entry saying "gpg: decryption failed: No secret key". I have browsed the forums but didn't find a similar topic/question, what am I doing wrong? What is the correct way to reencrypt one's pass entries after a key that was used to decrypt them gets expired?

I'm using pass v1.7.4, gpg 2.2.27 on an "Ubuntu 22.04 jammy" with Kernel: x86_64 Linux 6.8.0-65-generic

Solution edit:
Should've made a backup, shouldn't've deleted the secret gpg key that corresponds to the pass profile and the stored encrypted passwords.

probably related: https://unix.stackexchange.com/quest...-no-secret-key

pan64 Thanks! But I have already tried exporting and importing keys from gpg to gpg2 and the other way and the error is the same

Deleting the key was not a good idea. The file is encrypted using that key, and AFAIK cannot be decrypted without it. If you still have a copy of the original secret key there may be some hope, but without it the file cannot be decrypted. An expired key can be edited, and made to unexpire. Having an expiration date on a key used for local encryption is not my preference, but everyone's use case is different.

2 members found this post helpful.

Correct. The key "swapping" protocol is designed to protect against the original key not being obtainable. If you deleted it, GPG perceives that you may be an intruder or an imposter who never actually had it.

1 members found this post helpful.

Oh. Well there's a good way to loose all of your passwords I guess. Reading the documentation and the stuff on the web led me to believe that the expired key must be renewed. I didn't make a back up. I can still see my expired public key, but the secret one is deleted :/

you always need to have a reliable backup. Not only because of this case, but in general, anything, everything can go wrong.

1 members found this post helpful.

It is perhaps more important to keep backups of gpg keys than of most other data, and certainly the OS. One does need to carefully consider where to keep those backups, of course. What I do is keep them in folders encrypted by cryfs, which uses passwords, not a separate key. Obviously this requires a passphrase that isn't easily guessed or brute-forced. PGP/GPG public/private key encryption is secure, but the security does come at some cost, and there ain't no such thing as a free lunch. Another way to keep secure data and backups is with veracrypt, and I use that also. I don't trust a single backup method or location.

1 members found this post helpful.

Days ago I switch to pass too.

I worked on a self explained script that is not finished but maybe helps.
Inside notes to expand key expiration.
Works from a USB to have a backup.

https://www.linuxquestions.org/quest...2/#post6585559

1 members found this post helpful.

I copy such things onto removable USB "sticks" and keep them, labeled, in my desk drawer.

1 members found this post helpful.

Thank you all guys, I'll try better next time and take note of your advises! Have been using Linux for over a year now but it's still hard after decades of being a win user.

The ideas for a USB stick for backups and scripts are great, thanks!

One thing you might consider if you put your secret key and other sensitive information on a USB stick - it's possible, and I think an excellent idea, to encrypt the drive, or at least part of it. I use Veracrypt to put an encrypted container on the drive. It can also encrypt the entire drive if desired, and even put a hidden container which provides plausible deniability, so most people who might find it won't even know it exists. All you need for encrypting/decrypting/mounting the Veracrypt container is a password/passphrase. Obviously you need something hard to guess but easy to remember. A passphrase consisting of several words is preferable. Also on the drive I keep portable versions of Veracrypt, for both Linux and Windows, so I can run them on any computer I come across when I need the data. I suppose I could keep a MacOS version, but I don't know anyone who has a MacAnything. I carry my micro USB stick all the time, on a ring in my pocket with other things, so it's somewhat exposed to loss, and I don't want my data easily available to anyone who might get access to it.

1 members found this post helpful.

I personally do not go that far because I am certain where the USB sticks are. If I had doubts, I would GPG-encrypt the files and store the encryption certificate somewhere else. Good unless and until someone is pointing a loaded pistol at my temple . . .

If you needed to store the key information in an office setting which must be accessible by multiple trusted people, then yes, drive encryption might well be appropriate.

--- As for Windows: I think that their engineers have worked very, very hard to create solid security systems which are accessible to and manageable by "ordinary people," and geared to the particular needs of "enterprises." Of course their system is, from the very outset, very different from Linux/Unix, but it is no less well thought out. We must give the Devil his due. They became a billion-dollar company "the hard way." They really did earn it.

A possible disaster with data just stored at home, in whatever form, is that the house could burn to the ground, and everything in it lost. Or be washed away in a flood, or any number of other disasters. I don't totally trust purely local storage, even in a bank safety deposit box. Thus I store data I care about in multiple locations, including at home and in multiple cloud storage sites, but always encrypted in some way. I like cryfs a lot, because it's convenient, and I can easily sync the encrypted directories to anywhere, and decrypt locally. But I also keep the same data in Veracrypt containers, and in gpg-encrypted files, in multiple locations. One backup is never enough.

To me, encrypting data files and such using a key is not the best solution. It's easy enough to just use a passphrase, without any key. I've convinced myself that it's easier to lose a key, whether physical or virtual, much easier than a passphrase. It's not that hard to come up with a long but memorable only to me passphrase. It's easier, I think, if one has at least a basic knowledge of a language that uses a non-Latin alphabet, or which can be transliterated in multiple spellings.