I might be stupid, but how do I decrypt passwords in v2.0

[skyegecko]

I've just installed the version 2.0 preview from scratch due to the biometric bug affecting v1.3. I've imported my GPG key, the app indicated the import was successful and I can see my ID listed. But when I navigate to a password, I'm given no option to decrypt/view/copy it.

Long pressing causes the username to be copied, not the password. I see no buttons. I am never prompted for my GPG passphrase.

I hope this was enough description to go off, but I have no idea what I'm missing.

[msfjarvis]

It's probably a bug with the app. I've reverted a problematic commit just now, please grab the new snapshot once this workflow run has finished and try again. If that's still broken, please get a log: https://docs.passwordstore.app/docs/users/reporting-bugs

[skyegecko]

Thanks for the quick response! I get a prompt now but it's informing me my password is wrong.

I can take a log but I need to cook some food first, I'll get back to you in a couple of hours if you need more info from me.

[msfjarvis]

A log would be useful in that case. It's late here as well, so there's no hurry. Bon appetit :)

[cc8dea2e-4a29-4394-af6d-af0ccc73647a]

Hello!
I have the same problem.
I have already decided everything with food)), but with the app it’s not working out.
Here are the logs, but I'm confused by the inscription - "Not starting debugger since process cannot load the jdwp agent":

--------- beginning of main
01-04 01:29:35.189  2211  2211 I Zygote  : seccomp disabled by setenforce 0
01-04 01:29:35.200  2211  2211 E p.passwordstor: Not starting debugger since process cannot load the jdwp agent.
01-04 01:29:35.278  2211  2211 D NetworkSecurityConfig: No Network Security Config specified, using platform default
01-04 01:29:35.278  2211  2211 D NetworkSecurityConfig: No Network Security Config specified, using platform default
01-04 01:29:35.753  2211  2211 D AppCompatDelegate: Checking for metadata for AppLocalesMetadataHolderService : Service not found
01-04 01:29:35.832  2211  2211 I Choreographer: Skipped 31 frames!  The application may be doing too much work on its main thread.
01-04 01:29:35.853  2211 15828 I AdrenoGLES: QUALCOMM build                   : ff079d7, I14b0d72ae8
01-04 01:29:35.853  2211 15828 I AdrenoGLES: Build Date                       : 10/22/19
01-04 01:29:35.853  2211 15828 I AdrenoGLES: OpenGL ES Shader Compiler Version: EV031.27.05.02
01-04 01:29:35.853  2211 15828 I AdrenoGLES: Local Branch                     : 
01-04 01:29:35.853  2211 15828 I AdrenoGLES: Remote Branch                    : 
01-04 01:29:35.853  2211 15828 I AdrenoGLES: Remote Branch                    : 
01-04 01:29:35.853  2211 15828 I AdrenoGLES: Reconstruct Branch               : 
01-04 01:29:35.853  2211 15828 I AdrenoGLES: Build Config                     : S P 8.0.11 AArch64
01-04 01:29:35.859  2211 15828 I AdrenoGLES: PFP: 0x016ee187, ME: 0x00000000
01-04 01:29:35.850  2211  2211 I RenderThread: type=1400 audit(0.0:1906): avc: denied { search } for name="kgsl-3d0" dev="sysfs" ino=43798 scontext=u:r:untrusted_app:s0:c199,c256,c512,c768 tcontext=u:object_r:sysfs_kgsl:s0 tclass=dir permissive=1 app=app.passwordstore
01-04 01:29:35.892  2211 15828 I Gralloc4: mapper 4.x is not supported
01-04 01:29:35.893  2211 15828 W Gralloc3: mapper 3.x is not supported
01-04 01:29:37.616  2211  2211 W RecyclerView: No adapter attached; skipping layout
01-04 01:29:37.801  2211  2211 I AssistStructure: Flattened final assist data: 3584 bytes, containing 2 windows, 29 views
01-04 01:29:38.098  2211  2211 W RecyclerView: No adapter attached; skipping layout
01-04 01:29:41.126  2211 15880 D ProfileInstaller: Skipping profile installation for app.passwordstore
01-04 01:29:46.348  2211 15828 D OpenGLRenderer: endAllActiveAnimators on 0x6fec982080 (RippleDrawable) with handle 0x6f0c947ba0
01-04 01:29:46.407  2211  2211 E StandaloneCoroutine: NoKeysProvidedException
01-04 01:29:46.407  2211  2211 E StandaloneCoroutine: 	at app.passwordstore.data.crypto.CryptoRepository.access$decryptPgp(Unknown Source:529)
01-04 01:29:46.407  2211  2211 E StandaloneCoroutine: 	at app.passwordstore.data.crypto.CryptoRepository$decrypt$2.invokeSuspend(Unknown Source:38)
01-04 01:29:46.407  2211  2211 E StandaloneCoroutine: 	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(Unknown Source:8)
01-04 01:29:46.407  2211  2211 E StandaloneCoroutine: 	at kotlinx.coroutines.DispatchedTask.run(Unknown Source:114)
01-04 01:29:46.407  2211  2211 E StandaloneCoroutine: 	at androidx.core.app.ActivityRecreator$1.run(Unknown Source:76)
01-04 01:29:46.407  2211  2211 E StandaloneCoroutine: 	at kotlinx.coroutines.scheduling.TaskImpl.run(Unknown Source:2)
01-04 01:29:46.407  2211  2211 E StandaloneCoroutine: 	at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(Unknown Source:91)
01-04 01:29:46.521  2211  2211 W IInputConnectionWrapper: requestCursorAnchorInfo on inactive InputConnection
01-04 01:29:46.563  2211  2211 W RecyclerView: No adapter attached; skipping layout
01-04 01:29:46.576  2211  2211 I AssistStructure: Flattened final assist data: 3584 bytes, containing 2 windows, 29 views
01-04 01:29:46.720  2211  2211 W RecyclerView: No adapter attached; skipping layout

[msfjarvis]

@cc8dea2e-4a29-4394-af6d-af0ccc73647a you don't have the same problem, your log clearly states you haven't imported any PGP keys into the app so you should start with that.

[cc8dea2e-4a29-4394-af6d-af0ccc73647a]

@msfjarvis key added, app indicated the import was successful, but i cant use it - message saying that the passphrase is incorrect, when I try to view saved passwords. I'm sure I'm entering the correct passphrase for the key.

[msfjarvis]

@cc8dea2e-4a29-4394-af6d-af0ccc73647a capture a log and file a separate issue please https://docs.passwordstore.app/docs/users/reporting-bugs/

[skyegecko]

Woops, that was a long time spent cooking 😅

Log below:

--------- beginning of main
01-05 19:36:24.701 17035 17035 I p.passwordstore: Using CollectorTypeCMC GC.
01-05 19:36:24.703 17035 17035 E p.passwordstore: Not starting debugger since process cannot load the jdwp agent.
01-05 19:36:24.709 17035 17035 D CompatibilityChangeReporter: Compat change id reported: 171979766; UID 10399; state: ENABLED
01-05 19:36:24.709 17035 17035 D CompatibilityChangeReporter: Compat change id reported: 242716250; UID 10399; state: ENABLED
01-05 19:36:24.718 17035 17035 D nativeloader: Configuring clns-4 for other apk /data/app/~~A-bOf-7ADMvT59SyPfqiXw==/app.passwordstore-2EyUQc4Iw6hqGAKvXOV8vQ==/base.apk. target_sdk_version=34, uses_libraries=, library_path=/data/app/~~A-bOf-7ADMvT59SyPfqiXw==/app.passwordstore-2EyUQc4Iw6hqGAKvXOV8vQ==/lib/arm64:/data/app/~~A-bOf-7ADMvT59SyPfqiXw==/app.passwordstore-2EyUQc4Iw6hqGAKvXOV8vQ==/base.apk!/lib/arm64-v8a, permitted_path=/data:/mnt/expand:/data/user/0/app.passwordstore
01-05 19:36:24.723 17035 17035 V GraphicsEnvironment: Currently set values for:
01-05 19:36:24.723 17035 17035 V GraphicsEnvironment:   angle_gl_driver_selection_pkgs=[]
01-05 19:36:24.723 17035 17035 V GraphicsEnvironment:   angle_gl_driver_selection_values=[]
01-05 19:36:24.723 17035 17035 V GraphicsEnvironment: ANGLE GameManagerService for app.passwordstore: false
01-05 19:36:24.723 17035 17035 V GraphicsEnvironment: app.passwordstore is not listed in per-application setting
01-05 19:36:24.723 17035 17035 V GraphicsEnvironment: Neither updatable production driver nor prerelease driver is supported.
01-05 19:36:24.724 17035 17035 D Sentry  : io.sentry.auto-init read: true
01-05 19:36:24.724 17035 17035 I Sentry  : Retrieving auto-init from AndroidManifest.xml
01-05 19:36:24.726 17035 17035 W pool-2-thread-1: type=1400 audit(0.0:369): avc:  denied  { read } for  name="version" dev="proc" ino=4026532008 scontext=u:r:untrusted_app:s0:c143,c257,c512,c768 tcontext=u:object_r:proc_version:s0 tclass=file permissive=0 app=app.passwordstore
01-05 19:36:24.732 17035 17058 D CompatibilityChangeReporter: Compat change id reported: 263076149; UID 10399; state: ENABLED
01-05 19:36:24.735 17035 17058 D TrafficStats: tagSocket(73) with statsTag=0xffffffff, statsUid=-1
01-05 19:36:24.796 17035 17070 D vulkan  : searching for layers in '/data/app/~~A-bOf-7ADMvT59SyPfqiXw==/app.passwordstore-2EyUQc4Iw6hqGAKvXOV8vQ==/lib/arm64'
01-05 19:36:24.797 17035 17070 D vulkan  : searching for layers in '/data/app/~~A-bOf-7ADMvT59SyPfqiXw==/app.passwordstore-2EyUQc4Iw6hqGAKvXOV8vQ==/base.apk!/lib/arm64-v8a'
01-05 19:36:24.797 17035 17070 I DMABUFHEAPS: Using DMA-BUF heap named: vframe-secure
01-05 19:36:24.798 17035 17035 D AppCompatDelegate: Checking for metadata for AppLocalesMetadataHolderService : Service not found
01-05 19:36:24.825 17035 17035 D CompatibilityChangeReporter: Compat change id reported: 237531167; UID 10399; state: DISABLED
01-05 19:36:24.837 17035 17058 D TrafficStats: tagSocket(97) with statsTag=0xffffffff, statsUid=-1
01-05 19:36:24.875 17035 17035 D CompatibilityChangeReporter: Compat change id reported: 210923482; UID 10399; state: ENABLED
01-05 19:36:24.882 17035 17035 W WindowOnBackDispatcher: OnBackInvokedCallback is not enabled for the application.
01-05 19:36:24.882 17035 17035 W WindowOnBackDispatcher: Set 'android:enableOnBackInvokedCallback="true"' in the application manifest.
01-05 19:36:24.889 17035 17058 D TrafficStats: tagSocket(97) with statsTag=0xffffffff, statsUid=-1
01-05 19:36:24.891 17035 17097 D CompatibilityChangeReporter: Compat change id reported: 247079863; UID 10399; state: ENABLED
01-05 19:36:25.444 17035 17035 W WindowOnBackDispatcher: sendCancelIfRunning: isInProgress=falsecallback=android.view.ViewRootImpl$$ExternalSyntheticLambda17@ed90d51
01-05 19:36:27.953 17035 17058 D TrafficStats: tagSocket(94) with statsTag=0xffffffff, statsUid=-1
01-05 19:36:30.284 17035 17107 D ProfileInstaller: Installing profile for app.passwordstore
01-05 19:36:47.791 17035 17035 D DefaultSelectionTracker: Ignoring onDataSetChange. No active selection.
01-05 19:36:47.803 17035 17043 W p.passwordstore: Cleared Reference was only reachable from finalizer (only reported once)
01-05 19:36:48.728 17035 17035 W RecyclerView: No adapter attached; skipping layout
01-05 19:36:48.734 17035 17035 W WindowOnBackDispatcher: OnBackInvokedCallback is not enabled for the application.
01-05 19:36:48.734 17035 17035 W WindowOnBackDispatcher: Set 'android:enableOnBackInvokedCallback="true"' in the application manifest.
01-05 19:36:48.751 17035 17035 D CompatibilityChangeReporter: Compat change id reported: 171228096; UID 10399; state: ENABLED
01-05 19:36:48.777 17035 17035 D CompatibilityChangeReporter: Compat change id reported: 163400105; UID 10399; state: ENABLED
01-05 19:36:48.778 17035 17035 I AssistStructure: Flattened final assist data: 3632 bytes, containing 2 windows, 29 views
01-05 19:36:48.899 17035 17035 D InsetsController: show(ime(), fromIme=true)
01-05 19:36:48.930 17035 17035 W RecyclerView: No adapter attached; skipping layout
01-05 19:36:49.104 17035 17035 I ImeTracker: app.passwordstore:489a7978: onShown
01-05 19:36:49.244 17035 17070 D OpenGLRenderer: endAllActiveAnimators on 0xb400007b126cc540 (LayerDrawable) with handle 0xb400007a226e0c70
01-05 19:36:51.766 17035 17058 D TrafficStats: tagSocket(5) with statsTag=0xffffffff, statsUid=-1
01-05 19:36:57.772 17035 17035 W WindowOnBackDispatcher: sendCancelIfRunning: isInProgress=falsecallback=ImeCallback=ImeOnBackInvokedCallback@254373029 Callback=android.window.IOnBackInvokedCallback$Stub$Proxy@d045f58
01-05 19:36:57.775 17035 17035 W WindowOnBackDispatcher: sendCancelIfRunning: isInProgress=falsecallback=android.view.ViewRootImpl$$ExternalSyntheticLambda17@fafa165
01-05 19:36:57.776 17035 17070 D OpenGLRenderer: endAllActiveAnimators on 0xb400007b126fc9c0 (RippleDrawable) with handle 0xb400007a226ac4a0
01-05 19:36:57.795 17035 17035 W WindowOnBackDispatcher: OnBackInvokedCallback is not enabled for the application.
01-05 19:36:57.795 17035 17035 W WindowOnBackDispatcher: Set 'android:enableOnBackInvokedCallback="true"' in the application manifest.
01-05 19:36:57.815 17035 17035 W RecyclerView: No adapter attached; skipping layout
01-05 19:36:57.826 17035 17035 W RemoteInputConnectionImpl: requestCursorUpdates on inactive InputConnection
01-05 19:36:57.826 17035 17035 I ImeTracker: app.passwordstore:2506391e: onCancelled at PHASE_CLIENT_APPLY_ANIMATION
01-05 19:36:57.837 17035 17035 E ImeBackDispatcher: Ime callback not found. Ignoring unregisterReceivedCallback. callbackId: 254373029
01-05 19:36:57.839 17035 17097 D org.pgpainless.decryption_verification.OpenPgpMessageInputStream: Symmetrically Encrypted Data Packet at depth 0 encountered
01-05 19:36:57.839 17035 17097 D org.pgpainless.decryption_verification.OpenPgpMessageInputStream: Symmetrically Encrypted Integrity-Protected Data has 0 SKESK(s) and 1 PKESK(s) from which 0 PKESK(s) have an anonymous recipient
01-05 19:36:57.839 17035 17097 D org.pgpainless.decryption_verification.OpenPgpMessageInputStream: Encountered PKESK for recipient 2E3A503CB6E65699
01-05 19:36:57.909 17035 17097 D org.pgpainless.key.info.KeyRingInfo: Subkey 2E3A503CB6E65699 was never validly bound.
01-05 19:36:57.909 17035 17097 D org.pgpainless.decryption_verification.OpenPgpMessageInputStream: Subkey 2e3a503cb6e65699 cannot be used for decryption.
01-05 19:36:57.909 17035 17097 D org.pgpainless.decryption_verification.OpenPgpMessageInputStream: Skipping PKESK because no matching key 2E3A503CB6E65699 was provided
01-05 19:36:57.909 17035 17097 D org.pgpainless.decryption_verification.OpenPgpMessageInputStream: Failed to decrypt encrypted data packet
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: app.passwordstore.crypto.errors.UnknownError
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: 	at app.passwordstore.data.crypto.CryptoRepository.access$decryptPgp(Unknown Source:573)
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: 	at app.passwordstore.data.crypto.CryptoRepository$decrypt$2.invokeSuspend(Unknown Source:38)
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: 	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(Unknown Source:8)
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: 	at kotlinx.coroutines.DispatchedTask.run(Unknown Source:114)
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: 	at com.google.android.gms.tasks.zzi.run(Unknown Source:76)
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: 	at kotlinx.coroutines.scheduling.TaskImpl.run(Unknown Source:2)
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: 	at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(Unknown Source:91)
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: Caused by: org.bouncycastle.openpgp.PGPKeyValidationException: No working decryption method found.
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: 	at org.pgpainless.decryption_verification.OpenPgpMessageInputStream.consumePackets(Unknown Source:2312)
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: 	at org.pgpainless.decryption_verification.OpenPgpMessageInputStream.<init>(SourceFile:55)
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: 	at com.google.crypto.tink.BinaryKeysetReader.withOptions(Unknown Source:53)
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: 	at app.passwordstore.data.crypto.CryptoRepository.access$decryptPgp(Unknown Source:419)
01-05 19:36:57.910 17035 17035 E StandaloneCoroutine: 	... 6 more
01-05 19:36:57.910 17035 17035 W WindowOnBackDispatcher: OnBackInvokedCallback is not enabled for the application.
01-05 19:36:57.910 17035 17035 W WindowOnBackDispatcher: Set 'android:enableOnBackInvokedCallback="true"' in the application manifest.
01-05 19:36:58.000 17035 17035 D InsetsController: show(ime(), fromIme=true)
01-05 19:36:58.026 17035 17035 W RecyclerView: No adapter attached; skipping layout
01-05 19:36:58.212 17035 17035 I ImeTracker: app.passwordstore:5d134788: onShown
01-05 19:37:14.995 17035 17035 D CompatibilityChangeReporter: Compat change id reported: 150939131; UID 10399; state: ENABLED

For reference, the secret key in question was exported using the command in the wiki:

gpg --export-secret-key $(cat ~/.password-store/.gpg-id) > pass-private.asc

Additionally, OpenKeyChain can use the same keyfile to successfully decrypt an encrypted file I manually copied from ~/.password-store/

[msfjarvis]

Looks like PGPainless, the library we now use for PGP is more strict about keys being valid than OpenKeychain. The library determined that your subkey 2E3A503CB6E65699 is not correctly bound to its parent key. It is possible that the subkey has expired

[skyegecko]

I don't have an expiry set, is that why it's struggling?

I'm not hugely familiar with GPG's workings. I've tried a --list-packets to inspect the key and personally I don't see anything out of place, do you recognise something? I see now that there are two signatures with different dates (this was because I altered the user information I believe) but the private key does seem to be bound.

gpg --export-secret-key $(cat ~/.password-store/.gpg-id) | gpg --list-packets
# off=0 ctb=95 tag=5 hlen=3 plen=1862
:secret key packet:
        version 4, algo 1, created 1487936120, expires 0
        pkey[0]: [4096 bits]
        pkey[1]: [17 bits]
        iter+salt S2K, algo: 7, SHA1 protection, hash: 2, salt: XXXXXXXXXXX
        protect count: 65011712 (255)
        protect IV:  XXXXXXXXXXXX
        skey[2]: [v4 protected]
        keyid: 2768D7C69BD2C4B1
# off=1865 ctb=b4 tag=13 hlen=2 plen=34
:user ID packet: "XXXXXXXXXXXXX"
# off=1901 ctb=89 tag=2 hlen=3 plen=590
:signature packet: algo 1, keyid 2768D7C69BD2C4B1
        version 4, created 1686491165, md5len 0, sigclass 0x13
        digest algo 10, begin of digest 1b c2
        hashed subpkt 33 len 21 (issuer fpr v4 3E8F31485F0D715D3BC06E472768D7C69BD2C4B1)
        hashed subpkt 2 len 4 (sig created 2023-06-11)
        hashed subpkt 27 len 1 (key flags: 03)
        hashed subpkt 11 len 4 (pref-sym-algos: 9 8 7 2)
        hashed subpkt 21 len 5 (pref-hash-algos: 10 9 8 11 2)
        hashed subpkt 22 len 3 (pref-zip-algos: 2 3 1)
        hashed subpkt 30 len 1 (features: 01)
        hashed subpkt 23 len 1 (keyserver preferences: 80)
        subpkt 16 len 8 (issuer key ID 2768D7C69BD2C4B1)
        data: [4095 bits]
# off=2494 ctb=9d tag=7 hlen=3 plen=1862
:secret sub key packet:
        version 4, algo 1, created 1487936120, expires 0
        pkey[0]: [4096 bits]
        pkey[1]: [17 bits]
        iter+salt S2K, algo: 7, SHA1 protection, hash: 2, salt: XXXXXXXXXXXXX
        protect count: 65011712 (255)
        protect IV:  XXXXXXXXXXXXXXXXXXXX
        skey[2]: [v4 protected]
        keyid: 2E3A503CB6E65699
# off=4359 ctb=89 tag=2 hlen=3 plen=543
:signature packet: algo 1, keyid 2768D7C69BD2C4B1
        version 4, created 1487936120, md5len 0, sigclass 0x18
        digest algo 2, begin of digest a8 e3
        hashed subpkt 2 len 4 (sig created 2017-02-24)
        hashed subpkt 27 len 1 (key flags: 0C)
        subpkt 16 len 8 (issuer key ID 2768D7C69BD2C4B1)
        data: [4095 bits]

[msfjarvis]

I don't believe not having an expiry should be a problem. I'll try to find some time and come up with a reproduction case myself.