0

My public key had expired so I tried to edit the expiry date with

gpg --edit-key

It seemed to be too much trouble somehow to modify the correct subkey so I deleted the subkey instead with the intention to add a new one and send it to people but it was asking me to generate random data for ten minutes or so.

While thinking about what to do next I went to try to decrypt some old messages and it was now giving me

gpg: encrypted with RSA key, ID 1ZA9BKAC2F91307C
gpg: decryption failed: No secret key

When I run

gpg --list-secret-keys

the list of secret keys on the keyring seemed to be unchanged from before I deleted that subkey.

What has happened? Is it that that I somehow managed to delete a private subkey which was required for decryption?

Somehow I doubt it, am guessing more that GnuPG wants the public subkey attached to the private key, even if expired, so it can find which private key to use.

Does anyone know the remedy for this?

If it really comes to it I can ask someone to email me my old expired public key and try to reattach it, or on a hard drive in another town, I have this whole keypair backed up but believe that there is some quirk here in GnuPG and a possible fix for it.

Improve this question

1 Answer 1

Reset to default
4

Assuming you're using version 2 of GnuPG, the secret subkey should still be in your gnupg private-keys-v1.d subdirectory, but it's just a free-floating file and GnuPG isn't associating it with any key in its keyring. You should be able to use it again if you re-import your own public key that still contains the subkey you deleted.

Improve this answer
3
  • Yes, that fixed it, thanks :) Found the public key as ascii (.asc) in an email in my outbox and imported it and it all worked again like magic. During the import it mentioned '2 signatures' and 'one subkey'. Did not need to search for any free-floating files. That is very counter-intuitive that deleting an expired public key from the GnuPG keyring should break the decrypting 'master' key, not what you would think just from reading a high level explanation of how pgp works.
    – cardamom
    Commented Jun 13, 2022 at 19:06
  • 1
    @cardamom: PGP encryption -- and decryption -- nearly always use a subkey. For DSA+EG or ECDSA/EdDSA+ECDH, the masterkey cannot encrypt. Only for RSA is it technically possible to encrypt with the master key, and the default configuration created by GnuPG (--gen-key always and --full-gen-key default option 1) is a masterkey for SC (Sign,Certify) and a subkey for encryption (E).
    – dave_thompson_085
    Commented Jun 13, 2022 at 23:42
  • @dave_thompson_085 will this story about PGP encryption and decryption almost always using a subkey and not a masterkey was not part of the high level intros I read I almost feel like saying we were lied to. I wonder if that is the case for both GnuPG and OpenPGP.. Certainly, the new OpenPGP in Thunderbird lacks the ability to edit the subkeys created by GnuPG. This is an example of why PGP has a mixed reputation - if possible, best not to dig too far below the surface cause it gets messy..
    – cardamom
    Commented Jun 15, 2022 at 7:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .