10

I get confused about the terms used in the output of gpg --list-secret-keys

For example what is the meaning of following:

sec sec# ssb ssb>

there are many codes being used in the output. Can anyone point to the official docs where everything is explained?

I found this link but nothing is explained there.

Improve this question

3 Answers 3

Reset to default
8

Another info source is the DETAILS file in the GnuPG distribution.

Section "Field 1 - Type of record" states

Field 1 - Type of record

pub
Public key

crt
X.509 certificate

crs
X.509 certificate and private key available

sub
Subkey (secondary key)

sec
Secret key

ssb
Secret subkey (secondary key)

uid
User id

uat
User attribute (same as user id except for field 10).

sig
Signature

rev
Revocation signature

rvs
Revocation signature (standalone) [since 2.2.9]

fpr
Fingerprint (fingerprint is in field 10)

pkd
Public key data [*]

grp
Keygrip

rvk
Revocation key

tfs
TOFU statistics [*]

tru
Trust database information [*]

spk
Signature subpacket [*]

cfg
Configuration data [*]

Records marked with an asterisk are described at *Special fields.
Improve this answer
6
  • [sec] - The following is a secret key
  • [ssb] - The following is a secret sub key

The meaning of # after each of these is that the key is not usable, if say, you used the export subkeys option or if the key is otherwise taken "offline".

The meaning of > is that the key is stored on something like a smart card.

You can find more info here at Ubuntu's man page for GPG and the documentation you reference has been moved to here at GnuPG.org.

Improve this answer
3
  • 1
    Thanks for the answer. Is there place where I can see the detailed description of these codes? I couldn't find anything on both the urls you mentioned. I searched for 'ssb'
    – theguru42
    Commented Jun 23, 2017 at 9:16
  • @zaphod TBH I think the gnupg documentation is still lacking. Probably because they are moving to a new documentation format (which in the open source community can take a while). However I remembered a great walk-through by void. You can find it here: void.gr/kargig/blog/2013/12/02/… Read up on this and by the end you'll get it all. It should do in place of the documentation until they get that going again. The only thing it doesn't discuss is > which only means the key you are listing is on a device like a smartcard or usbkey or something.
    – Nalaurien
    Commented Jun 23, 2017 at 9:54
  • I asked about the official docs at dev.gnupg.org/T1563#122298
    – Ben Creasy
    Commented Feb 5, 2019 at 6:19
1

Based on in the information I have gathered:

On using command gpg -K which lists secret keys:

sec: the master/primary secret key. There is key size, keyid, creation date, expiration date and fingerprint information displayed.

ssb: secret subkeys. These can be your sub signing key, encryption key or authentication key. You can have multiple subkeys.

uid: this is the user information associated with the secret key. You can have multiple uids.

sec#: # after sec means that your secret key is missing from the machine. But it has a reference to the secret key.

ssb>: > after ssb means that your subkeys are not the machine. Instead they are on a smartcard.

On using command gpg -k which lists public keys:

pub: your public key info.

sub: your public subkey info.

If you have any other information which is missing. Please edit the answer or leave a comment.

Thanks to @Nalaurien for the previous answer.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .