Use specific subkeys without master key on different device using GPG

Question

On my main machine I use a specific gpg key (obviously). I use the unix pass password store to manage my passwords which are encrypted using this key. The store is pushed to a git repository. Now on my android device I use Password Store and OpenKeyChain to use my passwords.

What I would like to do is to only import subkeys in my android device without the master key so that when the device gets lost or stolen I do not need to revoke the master key and all associated subkeys.

Is this actually possible and if yes how would the procedure be?

Answer 1

pass and android password store use the gpg command behind the scenes, which means that a pure GnuPG solution is good enough, i.e. you can use the gpg command and both progrmas will simply pick up the keys.

Yet as of open keychain I have trouble to find whether it can import subkeys only. I need to argue that their github (and code) documentation is pretty poor but, I believe, that ui.adapte.ImportKeyAdapter.java can import a GnuPG export (you will need to try it, I do not have an android phone).

Now I assume that you create subkeys by (or equivalent):

$ gpg --edit-key <your key>
gpg> addkey

For example I have a couple of subkeys:

$ gpg -K 040E2771C840C4F6
sec   2048R/040E2771C840C4F6 2014-08-21
uid                          Michal Grochmal <>
uid                          Michal Grochmal <>
uid                          Michal Grochmal <>
ssb   2048R/C82957C790BA249B 2014-08-21
ssb   2048R/714F28317A0ACBDA 2015-02-15
ssb   2048R/780D6F342D47A4E2 2016-02-15
ssb   2048R/144EA814AC84FD73 2016-02-15

When I perform an export of subkeys only:

gpg -a -o subkeys --export-secret-subkeys 040E2771C840C4F6

I can then copy subkeys to another machine and import it:

gpg --import subkeys

When I list my key on this machine it shows a # next to the master key. It is GnuPG's way of telling you that the secret key is not really there.

$ gpg -K 040E2771C840C4F6
sec#  2048R/040E2771C840C4F6 2014-08-21
uid                          Michal Grochmal <>
uid                          Michal Grochmal <>
uid                          Michal Grochmal <>
ssb   2048R/C82957C790BA249B 2014-08-21 [expires: 2016-02-15]
ssb   2048R/714F28317A0ACBDA 2015-02-15 [expires: 2016-02-15]
ssb   2048R/780D6F342D47A4E2 2016-02-15 [expires: 2019-02-14]
ssb   2048R/144EA814AC84FD73 2016-02-15 [expires: 2019-02-14]

The extra reading is Debian's page about subkeys, it describes the process in much more detail. Yet, that page argues that you can export all secret keys, copy the file and then delete the master key on the device itself. That is possible, but I'll advise against it. A phone often implements storage in a similar fashion to solid state technology, which makes the file with your master key recoverable to a determined attacker.