Skip to main content
Removed tag-like question title.
Link
Jens Erat
  • 24.9k
  • 12
  • 82
  • 103

GPG Re-import secret primary key in GnuPG

Source Link

GPG Re-import secret primary key

Following the Debian tutorial on subkeys I like to create a keyring with a primary key (SC) and two subkeys (E and S) and then export and remove the secret primary key. However I struggle to re-import the exported secret key in case I want to revoke and renew the subkeys.

Initial setup with two subkeys

pub  1024R/158C07CE  created: 2015-09-21  expires: never       usage: SC
                     trust: ultimate      validity: ultimate
sub  1024R/588AC467  created: 2015-09-21  expires: never       usage: E
sub  1024R/3637E2AA  created: 2015-09-21  expires: never       usage: S
[ultimate] (1). Foobar

$ gpg -K

sec   1024R/158C07CE 2015-09-21
uid                  Foobar
ssb   1024R/588AC467 2015-09-21
ssb   1024R/3637E2AA 2015-09-21

# sec means the secret is still there

Export primarykey-only, export subkeys-only, remove secret keys, and re-import subkeys

$ gpg --export-secret-keys 158C07CE! > primary.sec
# secret-keys with exclamation mark just exports primary keypair
$ gpg --export-secret-subkeys 158C07CE > subs.sec
$ gpg --delete-secret-keys 158C07CE
$ gpg --import subs.sec
$ gpg -K

sec#  1024R/158C07CE 2015-09-21
uid                  Foobar
ssb   1024R/588AC467 2015-09-21
ssb   1024R/3637E2AA 2015-09-21

# sec# means the secret key is missing (this is what I want)

Now I want to re-import the primary secret key

$ gpg --allow-secret-key-import --import primary.sec

gpg: key 158C07CE: already in secret keyring
gpg: Total number processed: 1
gpg:       secret keys read: 1
gpg:  secret keys unchanged: 1

What? Why?

$ gpg -K

sec#  1024R/158C07CE 2015-09-21
uid                  Foobar
ssb   1024R/588AC467 2015-09-21
ssb   1024R/3637E2AA 2015-09-21

Here is useful Stackexchange article on which keys GPG exports in which case