[Help Needed] Error from OpenKeyChain: Encountered an error reading input data

[fabio-oesch]

I used gopass to create a random secret at /something/something-else with the password blub. I exported the gpg key with gpg --armor --export-secret-keys my-email > private_key and replaced my-email with my actual email address. I upload the file and import it in OpenKeyChain. The key seems to be fine since it tells me that the key is healthy but I haven't yet published it. After I've now imported the repository from git and want to get the password it tells me the above error. I'm not very good with gpg so any help is greatly appreciated.

[msfjarvis]

I cannot replicate this bug on my devices and nobody who's reported it so far has provided me with device logs, heavily impeding my ability to debug and resolve this. If that changes at any point, I'll post an update here.

[fabio-oesch]

I am going to try to get some device logs this evening. I just haven't set it up at the moment and I'm working until this evening. Thank you for your quick response.

[fabio-oesch]

I've also realised that in OpenKeyChain under Apps -> Password Store I added a tick. But that didn't help me either. You might need to give me some pointers how I can log the output correctly. I've been trying but I don't get any useful logs whatsoever. What I've tried so far. I've installed adb and I've been trying to use logcat with it. The following commands are not very useful:

adb logcat --pid=(adb shell pidof -s dev.msfjarvis.aps) <my device id> # doesn't return any error whatsoever
adb logcat --pid=(adb shell pidof -s org.sufficientlysecure.keychain) <my device id> # at some point just errors out because of unexpected EOF
adb -d logcat dev.msfjarvis.aps -s <my device id> # doesn't show anything

So if you could give me some advice, that be very helpful.

[vsrivatsan89]

I'm also facing the same issue. I've tried both pass and gopass to create some entries on the laptop. The reading of these entries fail in the APS app with the above "...Encountered an error reading input data" error.

Findings:

• The key imported into OpenKeyChain is fine because i'm able to create a new entry via the app and read properly with same key on my computer.
• The issue seems to be reading encrypted data coming from laptop

Details:
gpg version:

gpg (GnuPG) 2.3.1
libgcrypt 1.9.3

Phone: Pixel 3 XL

Steps done to further debug:
This above findings lead me to see if it's the issue of secrets being stored in binary form vs armored-ascii. I noticed that the app created secrets are stored in ascii form. Therefore, I set PASSWORD_STORE_GPG_OPTS=--armor for pass on laptop and created secret on the laptop. Then I confirmed that the file imported to phone was in ascii (Which it was).
Unfortunately, the problem still exists.

[vsrivatsan89]

I'm thinking this is an OpenKeyChain issue. It's not able to decrypt the file properly.

[msfjarvis]

It is definitely an OpenKeychain issue but I still want to see if I can work around it on my end somehow. If no issue has been filed at OpenKeychain it would be a good idea to start with that.

FWIW, We've changed our behavior in the development tree to match pass and not use ASCII armor when encrypting.

[vsrivatsan89]

Feels like OpenKeyChain issue #2096 is related, but it's been open since 2017. I can file an issue with them again to see if we get some traction. In the meantime, I'll try to get you debug logs from my phone.

[vsrivatsan89]

Update: It ended up being the GPG version installed on my laptop. I had done brew install gpg .

To fix:

1. brew uninstall --ignore-dependencies gpg
2. Download and install https://sourceforge.net/projects/gpgosx/files/GnuPG-2.2.28.dmg/download
3. Enjoy everything magically working in harmony

[bercly0b]

thanks a lot, it's work for me 👍

[Jimmy2027]

What are the exact steps to follow in order to solve this issue? I did the following but the problem still persists:

• install gnupg-2.2.36 (I had 2.3.6-r1 before)
• re-encrypt the passwords with pass init my@email.com
• I sent over the key to my phone on OpenKeychain

But I still get Error from OpenKeyChain: Encountered an error reading input data on Android Password Store

[npes-95]

According to this post, OpenKeyChain doesn't suport AEAD encryption (default in gpg 2.3). Dropping the OCB option from the key's preference string also fixed the issue for me:

$ gpg --edit-key <key-id>
gpg> showpref
[ultimate] (1).name <email>
     Cipher: AES256, AES192, AES, 3DES
     AEAD: OCB
     Digest: SHA512, SHA384, SHA256, SHA224, SHA1
     Compression: ZLIB, BZIP2, ZIP, Uncompressed
     Features: MDC, AEAD, Keyserver no-modify
gpg> setpref AES256 AES192 AES 3DES SHA512 SHA384 SHA256 SHA224 SHA1 ZLIB BZIP2 ZIP
Set preference list to:
     Cipher: AES256, AES192, AES, 3DES
     AEAD:
     Digest: SHA512, SHA384, SHA256, SHA224, SHA1
     Compression: ZLIB, BZIP2, ZIP, Uncompressed
     Features: MDC, Keyserver no-modify
Really update the preferences? (y/N) y
gpg> save
$ pass init <key-id>

[binarytom]

@npes-95
Thanks a lot, it's work for me and solve my doubt.

[tomsaleeba]

the solution from npes-95 works, but if you've already pass init ... your store, doing it again with the edited key won't change anything. I solved that by generating another new key.

So the workflow is:

• (currently on old GPG key, wanting to generate a new key)
• generate new key
• use steps 👆 to edit the key and remove AEAD
• pass init ...
• pass git push
• export secret GPG key
• copy to Android device
• import new key
• if your old key is still in-date, delete it. Apparently only the "one in-date key" use case is supported
• (pull latest store git changes)
• decrypt a key
• (you'll be prompted to allow access to the new PGP key)