I have an OpenPGP key on a smart card that I've used for some time. I now wish to add some additional email-addresses to the key. So I insert my card into the reader and execute gpg2 --edit-key for my key followed by adduid. Everything works as intended until I confirm the operation. It then reports
gpg: secret key parts are not available
gpg: signing failed: Unusable secret key
I get this output with and without the smart card attached to my system,.
So I got a few questions:
- How can I add emails to my key on card without breaking any previous signatures?
- Is that a safe thing to do?
- Do I need to download the key to a safe machine to do the edit there?
- I assume I'll need to redistribute my public key after adding the uid. Does that mean that others need to sign my public key again?
EDIT: Changed formatting to make the output of gpg more clear. Also changed some grammar.
EDIT2: This is what GPG says to other commands:
gpg -K
/Users/jako/.gnupg/secring.gpg
------------------------------
sec# 2048R/A62B19E0 2016-06-01
uid My Name <mymail>
ssb> 2048R/B93264B8 2016-06-01
ssb> 2048R/D252B29D 2016-06-01
ssb> 2048R/431513E0 2016-06-01
ssb# 2048R/594CAEC2 2016-06-01
gpg --card-status
....
General key info..: sub 2048R/B93264B8 2016-06-01 My Name <mymail>
sec# 2048R/A62B19E0 created: 2016-06-01 expires: never
ssb> 2048R/B93264B8 created: 2016-06-01 expires: never
card-no: 0005 00004899
ssb> 2048R/D252B29D created: 2016-06-01 expires: never
card-no: 0005 00004899
ssb> 2048R/431513E0 created: 2016-06-01 expires: never
card-no: 0005 00004899
ssb# 2048R/594CAEC2 created: 2016-06-01 expires: never
parts of the secret key are missingis the exact output of gpg. I'll edit the question to make that more clear.gpg -K,gpg --card-status? Is it possible you only stored the subkeys on the card? You don't really add user IDs to the card, but to the public key (which is not stored on the card at all). The ID is signed by the primary private key, which might be on the card and cannot be located by GnuPG, at least that's what the error message says.sec#means that the main secret key is simply not there. It was either removed or the export was made without it. You can''t add UIDs or extra keys to the keychain without that key.