Forgot PGP private key passphrase

[tr333]

I setup a PGP key for myself a few years ago, and I have now forgotten the passphrase I set for the private key. Is there any way to revoke the key without the passphrase, or do I just have to keep trying to remember it?

[tubbygweilo]

tr333, The Gnu Privacy Guard Howto may offer some help but I fear you will need the passphrase or at the very least the revocation certificate before you can revoke your key. It is often recommended that you create a revocation certificate when you create your key pair.

[tr333]

Thanks. Looks like I'm up for creating a new PGP key

[tubbygweilo]

Thanks. Looks like I'm up for creating a new PGP key

It happened to me when I started using gnupg with enigmail. I expect you and I are not the only ones on this forum to have suffered this fate

[Bachstelze]

Hence why you should always create the revocation certificate right after you crzeate your key.

[amarendra]

Me too. However I am still struggling to remember my passphrase. Some 5-6 days. I will give it one more week before I create a new one. However, I have got a revocation certificate.

One lesson learnt - Whatever is being said for the safety, but just don't create a so tough passphrase that it's tough or almost impossible to remember, as you are not supposed to write it anywhere. Better keep it relatively easy (not easy).
After all there's no point in changing keys every 6 months or so.

At one point the frustration told me to write it down for the next time which is bad

[BkkBonanza]

Or use Keepassx. I have hundreds of passwords and I could never remember them all. I don't see how people can use different passwords on all the sites they use without a password safe. Well, I suppose there are derivation schemes and such but for me it just seems a lot easier to use the password safe.

There is a PPA for Keepassx, which makes it easy to install and keep current,

https://launchpad.net/~keepassx/+archive/ppa

[Sarmacid]

I remember this happening to me. To be able to decrypt my files again I had make a script to bruteforce GPG with the most likely combination of the passphrase I had that was about 12 characters, luckily enough it worked

[BkkBonanza]

@Sarmacid,
How long did that take?
I guess you had a good idea what it looked like before coding it.

[amarendra]

@BkkBonanza, then KeePassX will get me one more password to remember and even that can be compromised. I use weave for Firefox but there I couldn't have saved my passphrase, could I?

@Sarmacid, Can you share the script or tell me how to bruteforce my own passphrase? I also have a fair idea of what is it.. e.g. say my passphrase was:

AbCdEf123

or

AeBfCd123

or sth like that,
Then I just don't remember whether the CAPITALIZATION alteration was starting with a capital or small. And a digit or two's confusion in the end digit.
However the passphrase was more than 10 characters..

Any other good tool or method will be highly appreciated. I just don't want to revoke the key and start all over again.
And, I think I should learn what features KeePassX does have. I have always assumed that it's another thing like weave.