jleight / gpgkee

Key Provider plugin for KeePass using GPG.

GpgKee

GpgKee is a KeePass plugin that provides GPG authentication.

WARNING

The GpgKee plugin is EXTREMELY basic. There is no guarantee that it will work for you. There is no error handling. There are no tests of any sort. Do not use this plugin unless you are willing to lose everything in your KeePass database.

About

GpgKee can be used as a secondary component to your KeePass master key. It uses the GPG application on your computer to decrypt an encrypted secret key. If it is able to decrypt the key, the key is passed along to KeePass to decrypt your password database.

GpgKee is currently very minimal. There are no GUI components to help you generate your encrypted secret key and there is no error handling. These components should be added eventually, but the plugin works in its current state.

Usage

GpgKee currently has two requirements:

1. You must have Gpg4win installed to the default location. GpgKee is hard coded to use the gpg2 executable located at C:\Program Files (x86)\GNU\GnuPG\pub\gpg2.exe.
2. Your pinentry must open in a new window so that when GpgKee executes the gpg2 application, the pinentry application can prompt you for your password.

Generate GpgKee File

Once you have Gpg4win installed and configured, you need to generate a secret key. You can use anything you want as the secret key.

Once you have a secret key, encrypt it with GPG:

gpg2 --output secret-key.gpg --encrypt --recipient *your public key* secret.key

Once you have your encrypted secret key, move it to the same folder as your KeePass kbdx file and rename it the same name as your KeePass database with a ".gpgkee" extension.

For example, if your KeePass database is called "Personal.kbdx", name your gpg encrypted secret key "Personal.gpgkee".

Change Master Key

Now that your secret key is set up, you can change your master key to use the GpgKee secret key.

1. Open your KeePass database.
2. Click File >> Change Master Key...
3. Check the "Key file / provider" checkbox.
4. Select the "GPG Authentication" provider.
5. Click OK.
6. Type in your GPG key pin if you are prompted.
7. Save your database.

If all went according to plan, when you open your database again, you will be prompted for your GPG key pin and your password database will open.

gpgkee's Issues

Request to take this codebase over to request it get included in the 2.x Plugins.

@jleight This is a great plugin, and I'm very surprised that it never made it into the official plugin listing. My main goals will be to expand this plugin with the following MINOR additions:

• Determine why PLGX builds of this plugin don't register
• Test cross-os (Windows / Linux / Mac) functionality
• Add runtime OS detection to switch between Windows / Linux / Mac
• Publish and maintain binary (DLL or PLGX) releases with GPG signatures
• Make the build reproducible through Docker
• Publish a howto or wiki on how to do a reproducible build attestment
• Petition to have this listed in the official Keepass2 2.x plugin page

Please let me know your thoughts or concerns about any of these goals, or if you would prefer these be accomplished through PR's here, I'll be happy to work it that way as well.

My fork I will be with is working https://github.com/brianddk/gpgkee

Thx, @brianddk