website/content/posts/pass-android-yubikey.md

+++ title = "Unix pass and Android Password Store with YubiKey" date = 2025-01-01 description = "Setting Up Unix pass with YubiKey and Android Password Store" +++

Using a secure and versatile password manager is a must for managing your digital life, and pass, the Unix password manager, is a fantastic choice. If you store your GPG key on a YubiKey and use the Android Password Store app with OpenKeychain, this guide will help you set everything up while addressing a common compatibility issue with throw-keyids in gpg.conf.

What You’ll Need

• A YubiKey configured with your GPG key (see the excellent YubiKey-Guide by drduh).
• The pass command-line utility.
• OpenKeychain installed on your Android device.
• The Android Password Store app.

Configuring pass with a YubiKey-Stored GPG Key

1. Set up your YubiKey and GPG key

   • Follow the steps in drduh’s YubiKey guide to create and configure your GPG key on your YubiKey.

2. Install pass

   • Install the pass utility on your Linux system. Most distributions have it in their package repositories:

   apt install pass       # For Debian/Ubuntu-based distros
   xbps-install -S pass   # For Void Linux
   

3. Initialize pass with your GPG key

   • Run the following command to initialize the .password-store directory:

   pass init <KEYID>
   

   • Replace <KEYID> with your GPG key ID stored on the YubiKey.

4. Sync passwords to your Android device

   • Clone your .password-store repository to your Android device and set up the Password Store app with OpenKeychain.

The throw-keyids Issue

While working through this issue, I found a helpful discussion in GitHub issue #173 for the Android Password Store repository. This thread provided insights that clarified the root cause of the problem and its resolution.

During setup, you might encounter an error in the Android Password Store app. OpenKeychain could report that the .gpg files are encrypted for a different key, even if they are not. This issue arises due to the throw-keyids option in ~/.gnupg/gpg.conf.

What Does throw-keyids Do?

The throw-keyids option in gpg.conf hides the recipient’s key ID during encryption. While this enhances privacy by preventing others from identifying the intended recipient(s), it can cause issues with OpenKeychain. OpenKeychain relies on visible key IDs to identify the correct decryption key, and without them, it assumes the files were encrypted for an unknown key.

Fixing the Issue

To resolve this, you need to disable throw-keyids and re-encrypt your password store.

1. Comment Out throw-keyids in gpg.conf

   • Open ~/.gnupg/gpg.conf in your favorite text editor and comment out the line:

   # throw-keyids
   

2. Re-encrypt Your Password Store

   • Run the following command to re-encrypt all passwords with the new GPG options:

   PASSWORD_STORE_GPG_OPTS="--no-throw-keyids" pass init <KEYID>
   

   • Replace <KEYID> with your GPG key ID.

3. Optional: Update Your Environment

   • To ensure --no-throw-keyids is always used, add the following line to your ~/.bashrc:

   export PASSWORD_STORE_GPG_OPTS='--no-throw-keyids' # Fix for OpenKeychain
   

   • While this step is not strictly necessary (since the change in gpg.conf resolves the issue), it can serve as a safeguard.

4. Sync the Updated Password Store

   • Push the updated .password-store to your remote repository and pull it on your Android device.

Conclusion

With these steps, you can seamlessly use pass with a YubiKey and the Android Password Store app. The issue with throw-keyids is a minor hurdle that can be resolved by adjusting your gpg.conf and re-encrypting your password store. Disabling throw-keyids makes your key IDs visible, which slightly reduces privacy but is necessary for compatibility with OpenKeychain.

For further details on pass, GPG, or YubiKey, refer to their respective documentation. A secure password manager setup like this ensures your sensitive information stays safe across devices.

References

• Standard unix password manager
• drduh's YubiKey Guide
• Android Password Store issue