[BUG] Exclamation point in key fingerprint

[kirelagin]

This is, in some sense, related to #998. Let me also say right away that I tried the 2021-03-26 snapshot and this issue is present there.

My .gpg-id contains two full fingerprints followed by !. The reason for this is that I have one PGP key with two encryptions subkeys: one for everyday use, one for backups. The exclamation point at the end tells GnuPG to use this exact subkey rather than doing its default lookup procedure, which would not result in what I want.

From the discussion at the issue referenced above, I understood that OpenKeychain allows full fingerprint as the key identifier, so, on the surface, it looks like the only required change would be to allow the trailing exclamation point when parsing .gpg-id.

I would also like someone more familiar with OpenKeychain to confirm that it will do the right thing when given the full key fingerprint (rather than doing GnuPG-like lookup via primary key).

[kirelagin]

Ok, I have now given a more careful read to the middle of that issue above and found comments from people who seem to have the same setup as mine. It seems to follow from the discussion that OpenKeychain, indeed, does not allow forcing a specific subkey for encryption, so, I guess this issue can be used as another justification for #1195.

[mist]

I am suffering the same problem. It worked before the big UI-overhaul some time ago, or so I think, as I did not check if I could set my subkey in .gpg-id and it probably was just by accident the correct key.

[Myridium]

I created a duplicate issue on this which I'm going to close. I'll paste here my version of this issue which may add more information:

Password-store for Android does not recognise a specific subkey selection, e.g. 141E0FE3342C4914! (note the exclamation mark at the end). The password-store program for UNIX does accept this, and in fact this feature is necessary in order to encrypt for a specific set of subkeys associated with a given identity. If you use only 141E0FE3342C4914 then gpg will select the newest encryption key it finds for the identity associated with 141E0FE3342C4914.

This feature is necessary in order to manage multiple encryption keys on different devices, which are aware of each other's public encryption keys as part of the user's identity.

To Reproduce
Steps to reproduce the behavior:

1. On GNU/Linux run pass init <myencryptionkey_in_0x_long_format>! including the exclamation mark at the end.
2. Synchronise password-store for Android with the created git repository.
3. Try creating a new password and saving it, as this is the step where the program tries to encrypt using the key recorded in .gpg-id. When you click the save button, you will receive the error Found .gpg-id, but it contains an invalid key ID, fingerprint or user ID

Expected behavior
password-store for Android should recognise the encryption key contained in .gpg-id and pass the encryption key straight to gpg with the exclamation mark on the end. gpg understands that a key with an exclamation mark at the end means to encrypt specifically for the given key, instead of the stupid default behaviour (where selecting the most recent encryption key available which is associated with the same identity).

Device information (please complete the following information):
App version is 1.13.4.

Additional context
Specific key selection is supported by both gpg and password-store on the desktop application. It should be supported here too. It's possible that all that needs to be done is to relax the error-checking of .gpg-id to allow keys with an exclamation mark at the end. I don't think any special treatement is required to handle these specific keys. They just need to be passed to gpg including the exclamation mark at the end.

[msfjarvis]

The app does not directly use GnuPG, so we can't pass anything to it. I'd like to know a bit more about this entire mechanism before I do any implementation work.

Given a key with two encryption subkeys ABCDEF...XYZ and 012345...9 where the latter is newer, which subkey(s) should be selected if:

• .gpg-id contains ABCDEF...XYZ
• .gpg-id contains 012345...9
• .gpg-id contains ABCDEF...XYZ

[Myridium]

Is that a typo @msfjarvis or did you intentionally omit the B?

Assuming it was a typo: I don't know what the OpenKeychain behaviour is, but password-store desktop passes the key straight to gpg, which will throw key away and pick the newest one associated with the same identity. When I say "newest" I'm not sure what the actual specific criteria are.

For example, I had three different encryption keys associated with the same identity, and added then to .gpg-id with pass init. Passwords are encrypted only for the newest of the three, because that's the key gpg encrypts for unless you use the exclamation mark.