3

I just set-up my yubikey 5 nfc with 3 seperate subkeys (S, E, A).

While encrypting and decrypting works fine (self-tested), I'm questioning the fact that gpg only ever asks me for the yubikey's pgp pin when performing decryption operations, but never actually asks me about the passphrase I protected the master key with (which I understand should have been inherited by each subkey).

I'm on windows but have already tried manually settings max cache times in gpg-agent.conf to 1, so as to "force" no-caching.

Can someone please shed some light on this behaviour?

Cheers

Improve this question

1 Answer 1

Reset to default
6

Encryption with GPG works using Public-key cryptography. All encryption is done with your public key (hence no password required here).

The password of your GPG master key is only used during creation of your subkeys. It works more like a CA here verifying that your subkeys are validated by your master key.

You're probably referring to guides like this where it says

The Master and subkeys will be encrypted with your passphrase when exported.

Which is true for your exported keys as a file.

So basically what you'll end up with after setting up your YubiKey like that is some GPG smartcard protected with your YubiKeys pin.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .