Package: trezor-gpg
# Trezor as a GPG passphraseInstall with:` pip installtrezor-gpg`Using this, when GPG needs to unlock a keytrezor_gpgwill bring up a keypad to enter your Trezor PIN.You may enter your PIN using the on-screen buttons or the keyboard grids` w e r      u i o      7 8 9 s d f      j k l      4 5 6 x c v      m , .      1 2 3 `Pressenterto submit the PIN,escapeto cancel, orbackspaceto clear the PIN.# Advantages and disadvantagesThis prevents passphrase keyloggingIt uses a difficult passphrase by defaultIt reduces the number of things you need to remember (assuming you already remember your Trezor PIN)If you’re using this for general encryption:It doesn’t protect your GPG secret from memory eavesdropping as would directly using Trezor’s decrypt/encrypt functionsIf you’re using this for a password manager likepassorgopass:If someone were to implement a direct-Trezor password manager without GPG the decryption key would never be in your computer memory, so unused passwords would be safer.Also, see the current limitations discussed below.# Installationgpg2must be installed and on yourPATH. This guide assumes you’re using the default GPG2 agent and not Seahorse.Runpip install trezor_gpgFind where it’s installed with by runningwhich trezor_gpgAdd this line to~/.gnupg/gpg-agent.conf:pinentry-program /path/to/trezor_gpgRunecho RELOADAGENT | gpg-connect-agentor restart your computer### Setting up Trezor passphrasesRuntrezor_gpg -a KEYIf your key has an existing non-Trezor passphrase, you need to remove the passphrase with the default pinentry program first (before doing step 3 above).Note: Responding to the old passphrase prompt requirestrezor_gpgto identify certain prompt messages - if you have messages in a language other than English this may not work.  Adding a passphrase may ask for you to press confirm on your Trezor up to 4 times.### Removing a Trezor passphraseRuntrezor_gpg -r KEYNote: Responding to the new passphrase prompt requirestrezor_gpgto identify certain prompt messages - if you have messages in a language other than English this may not work.### Disable redundant GPG passphrase cache
You may also want to disable GPG passphrase caching sinze Trezor has it’s own cache period. Add this togpg-agent.confor modify the value if it’s already there:`max-cache-ttl0 `and restart the agent via step 4 above.### ConfigurationSet these environment variables on yourgpg-agentdaemon, by overriding/usr/lib/systemd/user/gpg-agent.servicefor example.PINENTRY_TREZOR_DEBUG=1.  Write logs to~/.cache/trezor-gpg/log/debug.logPINENTRY_TREZOR_DONT_FLASH=1.  Don’t show which keypad button was pressed when using the keyboard.PINENTRY_TREZOR_KEYSET=123456789.  Use this letter grid for keyboard entry.# Current LimitationsThis doesn’t use locked memory, which meansthe decrypted passphrase may be written to diskif memory is paged out!No support for TTY entry since Pythongetpassis hardcoded to a specific TTYNo mixed passphrase support - all passphrased keys must have Trezor passphrases or nonePassphrases are based on the key fingerprint so they can’t be changed# How It Workstrezor_gpgacts as a pinentry program - when GPG needs to unlock an existing key or lock a new key it runstrezor_gpg.trezor_gpgtreats the key’s fingerprint as an encrypted blob and decrypts it to use as a synthetic passphrase.  The fingerprint is unique to the key and an inseparable property, so if you export the key and import it on another systemtrezor_gpgcan still retrieve all the information it needs.