I've seen "Re-import secret primary key in GnuPG" which is pretty much the issue I'm seeing, but I haven't had any luck with GnuPG 1.4.20 (from GPGTools) or GnuPG 2.1.
Even if I delete my entire ~/.gnupg
and try the import again, I can't seem to get the primary key secret to import. I'm assuming no keys are being merged when starting from scratch, so I don't understand why this wouldn't work even on GnuPG 1.4.
My backup file does contain the private key:
➜ ~ gpg --list-packets master-secret-key.gpg
:secret key packet:
version 4, algo 1, created 1459961571, expires 0
skey[0]: [4096 bits]
skey[1]: [17 bits]
gnu-dummy S2K, algo: 3, SHA1 protection, hash: 2
protect IV:
keyid: DBDE1E0253A3B420
...
Starting from scratch with an empty ~/.gnupg
:
➜ ~ gpg --allow-secret-key-import --import master-secret-key.gpg public-key.asc
gpg: key 53A3B420: secret key imported
gpg: key 53A3B420: public key "Rodrigo López Dato <[email protected]>" imported
gpg: key 7C4C5564: public key "Rodrigo López Dato <[email protected]>" imported
gpg: Total number processed: 2
gpg: imported: 2 (RSA: 2)
gpg: secret keys read: 1
gpg: secret keys imported: 1
➜ ~ gpg -K
/Users/rolodato/.gnupg/secring.gpg
----------------------------------
sec# 4096R/53A3B420 2016-04-06
uid Rodrigo López Dato <[email protected]>
uid Rodrigo López Dato <[email protected]>
ssb 2048R/00E7B480 2016-04-06
ssb 2048R/7D9F38D2 2016-04-06
sec#
means the private master key wasn't imported, why is that?
FWIW, I need the master key to generate a revocation certificate and to eventually renew my subkeys once they expire. If there's a way to do this from the backup directly without needing to import it, that would work too.