The gpg-agent in GnuPG

The gpg-agent is an important part of GnuPG that plays a similar role to the ssh-agent in OpenSSH. It has been integrated into the system as of GnuPG version 2.0.x and performs several tasks related to the management of keys and passphrases.

One of the main functions of the gpg-agent is to store private key passphrases in memory for a certain period of time. This eliminates the need to re-enter the passphrase each time it operates. The gpg-agent takes over the query of the passphrase from the user and stores it temporarily.

In GnuPG version 2.0.x, the gpg-agent is an optional element. However, as of version 2.1, it is an integral part, and all operations involving private keys are performed through the gpg-agent. This makes it possible to store the keys on another computer and use them only indirectly. An important feature of the gpg-agent in GnuPG 2.0.x is also access to smart cards.

The gpg-agent can be activated via environment variables that can be used by programs to communicate with the gpg-agent. For example, an email client such as Thunderbird can contact the gpg-agent via the environment variable GPG_AGENT_INFO. This allows programs to use the gpg-agent to manage private keys and retrieve passphrases.

In most Unix-like desktop environments, the gpg-agent starts automatically. If it is not running, it will be started automatically by gpg, gpgsm and gpgconf. You can also manually communicate with the gpg-agent via the gpg-connect-agent program to gain access to the stored passphrases.

Overall, the gpg-agent plays an important role in the secure management of keys and passphrases in GnuPG by simplifying and optimizing their access and use.

To check if the application is working correctly, you can use the mailbot of the GNU Privacy Project. To do this, you send an e-mail with your own public key as an attachment and receive back an e-mail encrypted with this key, which contains public key as a text block in the e-mail. Now you can import this key into the key management and use it to write an encrypted mail. The reply contains the contents of the message that was just encrypted, and that the message could be decrypted.

gpg-agent is mostly used as daemon to request and cache the password. gnupg comes with systemd user socket which are gpg-agent.socket, gpg-agent-extra.socket, gpg-agent-browser.socket, gpg-agent-ssh.socket, and dirmngr.socket.

gpg-agent can be configured via ~/.gnupg/gpg-agent.conf file. You can change cache ttl for unused keys: