I've seen "Re-import secret primary key in GnuPG" which is pretty much the issue I'm seeing, but I haven't had any luck with GnuPG 1.4.20 (from GPGTools) or GnuPG 2.1.

Even if I delete my entire ~/.gnupg and try the import again, I can't seem to get the primary key secret to import. I'm assuming no keys are being merged when starting from scratch, so I don't understand why this wouldn't work even on GnuPG 1.4.

My backup file does contain the private key:

➜  ~ gpg --list-packets master-secret-key.gpg
:secret key packet:
    version 4, algo 1, created 1459961571, expires 0
    skey[0]: [4096 bits]
    skey[1]: [17 bits]
    gnu-dummy S2K, algo: 3, SHA1 protection, hash: 2
    protect IV:
    keyid: DBDE1E0253A3B420

Starting from scratch with an empty ~/.gnupg:

➜  ~ gpg --allow-secret-key-import --import master-secret-key.gpg public-key.asc
gpg: key 53A3B420: secret key imported
gpg: key 53A3B420: public key "Rodrigo López Dato <rodrigo@auth0.com>" imported
gpg: key 7C4C5564: public key "Rodrigo López Dato <rolodato@rolodato.com>" imported
gpg: Total number processed: 2
gpg:               imported: 2  (RSA: 2)
gpg:       secret keys read: 1
gpg:   secret keys imported: 1
➜  ~ gpg -K
sec#  4096R/53A3B420 2016-04-06
uid                  Rodrigo López Dato <rolodato@rolodato.com>
uid                  Rodrigo López Dato <rodrigo@auth0.com>
ssb   2048R/00E7B480 2016-04-06
ssb   2048R/7D9F38D2 2016-04-06

sec# means the private master key wasn't imported, why is that?

FWIW, I need the master key to generate a revocation certificate and to eventually renew my subkeys once they expire. If there's a way to do this from the backup directly without needing to import it, that would work too.


The file you're trying to import does not contain the actual private key, as indicated by this line in the output of gpg --list-packets:

gnu-dummy S2K, algo: 3, SHA1 protection, hash: 2

The special "dummy" S2K algorithm is applied when GnuPG actually exported a secret key stub to still enable using secret subkeys, but having an offline primary key (on another computer, a disconnected thumb drive, an OpenPGP smartcard, ...). This key stub is also what you observe in the --list-secret-keys/-K output:

sec#  4096R/53A3B420 2016-04-06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.