The KMyMoney recovery key

KMyMoney has the ability to encrypt your data using GPG. Besides using your own key for encryption, KMyMoney supports the ability to encrypt your data with a recover key only available to a small set of core developers.

This key will have no effect if you always have access to your own key, but if you lose your key or the passphrase for it, the KMyMoney recover key comes in handy as now the core developers can help you to recover your financial data. The only thing you have to do upfront is to encrypt your data with the recover key. If you don’t do that, There is nothing we can do to help you.

Please read the details about the different key versions below.

Was it useful to KMyMoney users in the past?

For the second time I received an email with a request for help to decrypt a KMyMoney data encrypted with GPG where the user has lost his/her GPG-Key(ring). Unfortunately, in both cases KMyMoney’s recover key feature had not been used and I could not recover the data. If I had the ability to help in these cases (without the recover key) it would mean that I can successfully break any GPG encryption. Trust me, this is not the case.

The only thing that allows me to help a user in this situation is the KMyMoney recover key. Using this feature, you encrypt your data with your key and the recover key. In case you lose yours, you can send me the file and I can use the secret part of the recover key pair to decrypt it. I will ask you some questions about the contents of the file to make sure that the person who sends me the file is the legal owner of the file. You will also have to provide me with your new (public) key, which I will use to encrypt the file to send it back to you. This way, your data is never travelling over the internet in readable form.

BTW: I encrypt my data using my own key (the same I use to sign all my e-mails) and the recover key just for this purpose. I have stored a printed copy of the recover key as well as a CD containing it in a safe at my bank. This way, I can always reconstruct it and it is not getting lost.

Now, don’t ever tell me you have not used the recover key feature… you have been warned.

Different key versions

Key versions: KMyMoney versions up to version 5.1.3 use a key that was created in 2005. The length of this key (1024 bits) is meanwhile considered unsafe.

Therefore, newer KMyMoney versions will use a new key with a larger key size (4096 bits).

Import the recover key for your version of KMyMoney into your GPG keyring before you can use it with KMyMoney. Select encryption against this key in the Security settings dialog. Save your data. That’s it. BTW: both keys can co-exist in your keyring without problems.

Key for KMyMoney versions > 5.1.3 aka master

This key be found on a public key server.

Fingerprint: A642 9AEB 9EFF B2F9 C434 FC02 21F2 4701 1D0B ADF5

The ew key is signed with the old recover key and my own personal key (the numbers in parenthesis are the fingerprints of these keys):

Old KMyMoney recover key: 2E1B 19BB DE4A 9AD3 B51B C418 59B0 F826 D2B0 8440

My private key: D69A 745A 5533 1F44 F404 D825 8D4D E062 AA2E B01C

Key for KMyMoney versions <= 5.1.3

Please keep in mind that the usage of this key will expire on January 7th, 2025 and will not be extended.

This key be found on a public key server.

Fingerprint: 2E1B 19BB DE4A 9AD3 B51B C418 59B0 F826 D2B0 8440