How to import primary secret key from backup into GnuPG?

Question

I've seen "Re-import secret primary key in GnuPG" which is pretty much the issue I'm seeing, but I haven't had any luck with GnuPG 1.4.20 (from GPGTools) or GnuPG 2.1.

Even if I delete my entire ~/.gnupg and try the import again, I can't seem to get the primary key secret to import. I'm assuming no keys are being merged when starting from scratch, so I don't understand why this wouldn't work even on GnuPG 1.4.

My backup file does contain the private key:

➜  ~ gpg --list-packets master-secret-key.gpg
:secret key packet:
    version 4, algo 1, created 1459961571, expires 0
    skey[0]: [4096 bits]
    skey[1]: [17 bits]
    gnu-dummy S2K, algo: 3, SHA1 protection, hash: 2
    protect IV:
    keyid: DBDE1E0253A3B420
...

Starting from scratch with an empty ~/.gnupg:

➜  ~ gpg --allow-secret-key-import --import master-secret-key.gpg public-key.asc
gpg: key 53A3B420: secret key imported
gpg: key 53A3B420: public key "Rodrigo López Dato <[email protected]>" imported
gpg: key 7C4C5564: public key "Rodrigo López Dato <[email protected]>" imported
gpg: Total number processed: 2
gpg:               imported: 2  (RSA: 2)
gpg:       secret keys read: 1
gpg:   secret keys imported: 1
➜  ~ gpg -K
/Users/rolodato/.gnupg/secring.gpg
----------------------------------
sec#  4096R/53A3B420 2016-04-06
uid                  Rodrigo López Dato <[email protected]>
uid                  Rodrigo López Dato <[email protected]>
ssb   2048R/00E7B480 2016-04-06
ssb   2048R/7D9F38D2 2016-04-06

sec# means the private master key wasn't imported, why is that?

FWIW, I need the master key to generate a revocation certificate and to eventually renew my subkeys once they expire. If there's a way to do this from the backup directly without needing to import it, that would work too.

Answer 1

The file you're trying to import does not contain the actual private key, as indicated by this line in the output of gpg --list-packets:

gnu-dummy S2K, algo: 3, SHA1 protection, hash: 2

The special "dummy" S2K algorithm is applied when GnuPG actually exported a secret key stub to still enable using secret subkeys, but having an offline primary key (on another computer, a disconnected thumb drive, an OpenPGP smartcard, ...). This key stub is also what you observe in the --list-secret-keys/-K output:

sec#  4096R/53A3B420 2016-04-06