Kdewallet, "GPG vs Blowfish"

[michael_of]

Hi all,

A while ago (Ssh-agent and kdewallet) I’ve set up - with grateful help by some of you - KDE/Plasma Autostart settings for ssh-agent. Still works fine, in general.

As written in my old post, I’ve used a “sleep 30” for a desired delay, my barebone that time was pretty slow

Got a new one, recently. Which is much faster. Deleted the “sleep 30” line. But still a initial wait period of ~45-60 sec until pinentry-qtasks me for my PGP key PSK.

Does anyone know why this takes that long? Leap 15.6 boots in a few seconds (UEFI). After login into Plasma (Wayland) it again takes only a few seconds until everything is “up and running”, smooth and responsive. But even if I do “nothing” after login - it takes min. 45-50 sec.

Whereas - tested it yesterday evening - using a blowfish encrypted wallet, named kdewallet, same pw as login user - is as designed opened by default, in a way fast that I as a user don’t even recognize the interval between “not opened” and “open”.

Why am I asking in general? 45+ secs would (still) not be an issue, “who cares”

BUT: pinentry-qt is the first dialogue, asking for GPG PSK. Immediately after this, org.kde.akonadi_davgroupware_resourceasks me for my Nextcloud cal/card/webDAV user PW, also stored in kdewallet. “Asks” = new popup dialog, next to the pinentry-qt, but getting focus! Means: As my PWs are not that simple, and as I’m unfortunately not the “touch typing” guy, I’ve frequently looked on my keyboard while typing GPG PSK. Not recognizing that “I’m” already focused on the Akonadi dialogue. Frequently happened that I’ve pressed when believing that I’m ready - but now with a wrong PW for Nextcloud. And as Akonadi tries and tries and tries, after seconds I’ve frequently kicked myself out of my own Nextcloud instance, on my Leap VPS - “bruteforce protection” (NO chance to whitelist - external DHCP addresses at home…)

Solveable, always, but a pain in the neck

Hints would be highly appreciated!

[nrickert]

If “pam_kwallet” is installed, that attempts to open kwallet on login. But, because you are using gpg encryption, that prompts for a key. And it seems to take a while.

If you are instead using blowfish encryption with your login key as encryption key, then the opening of kwallet is pretty much immediate (handled during login using your login password).

Back when I was using Leap 15.5, I tabooed “pam_kwallet” to avoid problems. And it mostly worked. But for 15.6, I gave up and allowed “pam_kwallet” to do its thing. And I avoid allowing kwallet to hold my ssh keys, because I don’t consider the kwallet security to be strong enough for that.