GnuPG: Add passphrase to passphrase-less key

Question

I've created my PGP keypair using an online site. The thing is, I didn't provide a passphrase upon creation; The site didn't make supplying a passphrase mandatory.

Since this key is passphraseless, GnuPG asks for it everytime I want to encrypt something, or even when using it to sign commits. I don't have a passphrase, so when I provide an empty passphrase using pinentry, the program exits with error status after three attempts.

I've tried changing the passphrase via --edit-key, but this is impossible since it requests the passphrase. I also can't revoke it (I've uploaded the public key to the SKS Keyservers and Biglumber), it also asks for the passphrase.

I used --batch mode to import it into GnuPG without it asking for a passphrase, and it succeeded.

How could I go about adding a passhprase to this private key? I searched here on SuperUser (And Google), and all the solutions I found are not working, since they rely on a passphrase.

Decrypting content works on the site I originally created the keypair at (https://sela.io/pgp/). I know I shouldn't have used a website for key generation, but my PGP knowledge was practically non-existent.

Note: I can encrypt/decrypt text using my private key via other tools other than GnuPG (without a passphrase); Like the "PGP Anywhere" Chrome browser extension.

Thanks in advance.

Answer 1

I managed to revoke my key using an Android application called OpenKeychain.

This application is able to recognize passphrase-less keypairs and therefore able to revoke such keys.

This question might have gotten no attention, but I'm sure there are more people in a similar situation that might find this answer useful.

I can now upload this key to my computer and to the SKS keyservers, effectively deterring anyone from using it. But, a useful piece of advice: Create a revocation certificate for your key right after creating it, and store it in a safe place. Never ignore passphrase prompts; always use one.

This will save you from a big headache.

Answer 2

I've created my PGP keypair using an online site.

That's the worst possible thing you could ever do. Now you're not the only one that has the private key.

Always create a keypair yourself using gpg --gen-key.