Home / server / Questions / 806505
Accepted
john.dough
Asked: 2016-10-02 04:29:18 +0800 CST

Why does duplicity need a passphrase for OpenPGP encryption?

  • 772

I'd like to use duplicity to backup files and I'd like to encrypt them with GnuPG. I was wondering why duplicity asks for a passphrase to encrypt the files. For asymmetric encryption the passphrase is only needed for decryption.

I was using the following command:

duplicity full --encrypt-key="KEY-ID" --sign-key="KEY-ID" /path/to/source file://path/to/destination

I expected duplicity to use the public part of the given "KEY-ID" to encrypt the backup. Am I getting something wrong?

pgp duplicity gnupg openpgp

1 Answers

  1. Best Answer

    You're right, encryption only requires the public key, which is not protected by a passphrase.

    There are two reasons Duplicity might require the private key passphrase:

    • You ask duplicity to not only encrypt the backup, but also sign it. Signing is a private key operation (and thus requires the passphrase).
    • Duplicity needs to fetch the (encrypted) meta data information from the remote location, because the local copy is wrong/out of sync. Decryption is also a private key operation and requires the passphrase.
    • 6