I have a Yubikey Neo and is running GPGTools (GnuPG/MacGPG2 2.0.28) on OS X (10.11.2). I have generated a master key with SC abilities and separate signing and encryption keys which I have moved to the Yubikey via the
keytocard command. These are done on a separate offline computer.
On my day to day computer, I have only imported my public key. When I insert my Yubikey, and run
gpg --card-status, as expected it shows two secret subkeys. However, once the Yubikey is removed, I can run
gpg --list-secret-keys and it will show both my signing and encrypting secret subkeys. Furthermore, I can
gpg --export-secret-key and also reimport them, although these secrets keys are unable to perform any signatures or decrypt any files (again, with the Yubikey removed from the computer). This is very strange behaviour as seems like the computer is reading private keys from the Yubikey and storing it locally (even though these private keys are invalid).
Steps to reproduce:
- Start with empty GPG keychain, verify by
- Insert Yubikey with subkeys on it, verify these subkeys by
- Remove the Yubikey.
gpg --list-secret-keyand the subkeys from the Yubikey will appear.
- You may also run
gpg --armor --export-secret-key <key>and a private key will be printed (this private key does not seem to be able to perform any actions).
Am I misinterpreting any information?