encrypt an emacs org mode file

Question

I would like to do full file encryption of an org mode file. I would like just to have a password to open it - I believe its called symmetric encryption - no keyrings, public keys, etc because I know nothing about that.

So far I have learned that all I have to do is save an org mode file ending in .gpg or .org.gpg, and when I save, I get:

Select recipients for encryption.
If no one is selected, symmetric encryption will be performed.  
- ‘m’ to mark a key on the line
- ‘u’ to unmark a key on the line
[Cancel][OK]

I just click OK and I am prompted for the password. Wonderful.

When I close Emacs and view the file in another text editor, I can see the file is encrypted. Wonderful.

The problem comes in when I open the encrypted file - Emacs does not prompt me for the password. Emacs does report it decrypted the file and then it opens it.

I would like to be prompted for the password.

I have tried many different commands in both .emacs and in the file itself and nothing works. Eg:

(setq epa-file-cache-passphrase-for-symmetric-encryption nil)

I find that most articles seem to be old or for different versions of gpg or different types of encryption and so the commands suggested are not suitable.

What is the minimum amount of commands and what are those commands that I need to use to make sure encryption/decryption functions properly and securely and i will be prompted for the password each time I open the file?

I am using:

gpg (GnuPG) 2.2.20
libgcrypt 1.8.5

Answer 1

See this question on the Emacs SE site. It's a matter of configuring the default-cache-ttl setting in ~/.gnupg/gpg-agent.conf. The default is 300 seconds (5 mins), so the password is cached in gpg-agent for that long. Setting it to 0 makes sure that it is not cached.