13

I was trying to encrypt a file using a GPG public key.

It's working fine on my test server which is ubuntu 18.04 but when I try to use the same key on my production server (Amazon Linux) it failed to encrypt with a message

gpg: 40BXFE61: skipped: Unusable public key

There are other keys that are working fine, having problem with this key only.

I've already tried by trusting the keys (ultimate) and having expiry (Never).

Any suggestion or advice?

Thanks

Improve this question
2
  • 1
    Please run the command you were trying to run using gpg -v --debug lookup flags. This should help identify the issue better. My guess is that the key does not have a flag set to allow it being used for encryption. Can you sign a file with it?
    – user163495
    Commented Oct 9, 2019 at 11:45
  • I ran into the same problem and ended up here. The comment from user user163495 got me looking in the right direction. the issue I had was that signing validity period was set to unlimited and encrypting validity period had expired. This must have happened sometime in the past when the validity of the key was being changed from fixed date to unlimited.
    – vladimir123
    Commented Aug 27 at 7:39

4 Answers 4

Reset to default
11

It is possible that your key/subkey has expired.
Try gpg --edit-key <keyID>
This will show you the expiry of the individual primary and sub keys. If one of them has expired ,

  1. either create a new key (recommended for security)
    or
    2. renew its expiry date.
    This link will help in renewing. https://sites.lafayette.edu/newquisk/archives/504
Improve this answer
7

My guess would be that you are trying to use an ECC key (or subkey). The version of gnupg that comes with Amazon Linux is too old to support ECC cryptography. If you look at the output of gpg --list-key 40BXFE61, you can check for any pub or sub entries that have cv25519 or nistp256 in them, e.g.:

pub   rsa4096/E63EDCA9329DD07E 2011-11-07 [SC]
      DE0E66E32F1FDD0902666B96E63EDCA9329DD07E
uid                 [ultimate] Konstantin Ryabitsev <[email protected]>
sub   rsa4096/0BED129D9916360E 2015-11-02 [A]
sub   ed25519/B6C41CE35664996C 2018-02-09 [S]
sub   cv25519/86D203575A83079D 2018-05-02 [E]
sub   rsa2048/3FF293496E43D963 2018-05-02 [A]

GnuPG 2.0 and earlier only have support for RSA/DSA keys. Unfortunately, there isn't much you can do to support ECC keys on Amazon Linux, short of building gnupg-2.2+ on your own.

Improve this answer
2

I experienced this issue when the Trust got somehow wrongly set.

To correct in Ubuntu, I used Passwords and Keys application and set Override owner trust to Ultimate

Alternatively from the command line:

gpg --list-key

In the output identify the key's finger print, e.g. '7DD2204B5F2845832E588C33FAC3EB3BF321572E' and set the trust with:

echo '7DD2204B5F2845832E588C33FAC3EB3BF321572E:6:' | gpg --import-ownertrust

(i.e. to the fingerprint append ':6:' which identifies the level of the trust)

Improve this answer
2

I ran these commands on the openSUSE terminal to view and renew my GPG keys:

gpg --list-keys
gpg --edit-key "key id from the previous command"
expire
save
Improve this answer
2
  • 1
    Welcome to the community. Ugh, how do you renew the keys this way?
    – Sir Muffington
    Commented Feb 19 at 21:08
  • @SirMuffington I just renewed the expiration date by typing the above commands and following the prompts. The prompts were quite clear to me :)
    – Megidd
    Commented Feb 20 at 3:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .