A usable idea for PGP keys with a passphrase

[link2xt]

@gessel

If a user imports a passphrase encrypted key and passphrase protection is not implemented in delta chat, the message currently is completely unhelpful and misleading: “Bad setup code. Please Try again.” is unhelpful and unrelated to the actual problem. I would advise that if a user imports a passphrase encrypted key before Delta Chat adds a “enter passphrase to unlock your key into ram for a short window” dialog, it may be useful to offer a more helpful message like:

“This key is encrypted by a passphrase. Delta chat has chosen as a design philosophy convenience over security and does not support passphrase protected keys. You may create a new key within Delta Chat for use with delta chat and autocrypt. Remember to revoke your delta chat key if you lose control of your device at all, ever. All messages that have been encrypted with a compromised key can be read by any adversary having both the key and the messages and both are easily recoverable from this device unless it is physically permanently destroyed.”

Unhelpful error message should be treated as a bug indeed. Detecting passphrase-protected keys and telling they are not supported, then suggesting to create a separate key for Delta Chat and warning against decrypting primary long-term key is way better than current error message.

PGP experts may create an unencrypted subkey specifically for Delta Chat, but it is not always the best option. A new completely detached identity may be better for security.