Must GnuPG to have installed keys for every username profile?

Question

I'm running (on my local machine) the GPG (wingpg ) - command line version.

My login name at win7 - is RoyiN. ( so I have a profile for it)

When I logged in - I've installed the keys (using PKA.exe) both private and public.

All fine.

Then I wrote this code ( which is working )

  Process proc = new Process();
  proc.StartInfo.FileName = cfg.PGP_Program_FullPath;
  proc.StartInfo.UserName = "Royin";
  proc.StartInfo.Domain = ...;
  proc.StartInfo.Password = ...
  proc.StartInfo.Verb = "runas";
  proc.Start();
 ...

However if I write in the UserName field - another user which is also Administrator on my local machine - it says :

gpg: decryption failed: No secret key

Then I swapped again to RoyiN and it did work

• Are keys installed per user? is there a way to change that so it will be global ? ( so every user on the machine will be able to use these keys - without having to install the keys under each every profile) ?

• It also implies that if i want to allow other's to connect to my computer - I must be logged on with RoiyN 24/7....

Is there any workaround for this ?

Answer 1

There are two different things happening here that are related to the "person" running gpg.

• GPG searches for keys in the default keyring files, which are installed in your user profile directory (under a folder named .gnupg). This will be a set of files like pubring.gpg and secring.gpg. This part is easy to work around: pass --secret-keyring "path\to\file" as one of the parameters and it will add that keyring file to its search path. You may want to move it to a publically readable location, like %ALLUSERSPROFILE%, first.

• Apart from that, GnuPG keys are generated for and tied to an identity, which is usually your email address. When receiving files, the data will specify the identify of the person who's key is needed to decrypt and/or verify the integrity. When encrypting or signing files, you have to tell GPG who's key to use. Your secret key is used when you sign things for others, or when you decrypt data sent to you. You need to make sure the appropriate keys are in whatever keyring file you use, regardless of where it is.

There's no need for you to actually stay logged in when you run gpg, if you give it an explicit location for the data. It's simply that gpg, by default, reads the current environment variables, set at login, to determine where those things are.

You'll probably need to specify a keyring file path, a secret keyring file path, and a configuration file path if you want to run GPG unattended. The entire list of options you can specify is on the GPG Configuration Options page.

(You may want to try starting with just the --homedir option, which I think will override the default paths for everything else in one go, but you'd need to test that to make sure.)

Answer 2

Yes, they are installed on per-user basis

Simple answer - just export the private/public key pair, and install it for the Administrator account as well.

Although, it'd be better to create a separate key for your automated system with own public key - whoever has your key with a high level of trust, will accept this one as well.