2

I just got a Yubikey 4 and I generate the key with gpg2 --card-edit and now I have this:

$ gpg2 --list-key
/home/lilas/.gnupg/pubring.kbx
------------------------------
pub   rsa2048/EA3829E3 2016-11-08 [SC]
uid         [ultimate] Yubikey Test <yubikey@test.org>
sub   rsa2048/47C539AE 2016-11-08 [A]
sub   rsa2048/AC969F81 2016-11-08 [E]

If I don't specify the recipient, evething works fine, but if I specify it it show me the warning

gpg: WARNING: recipients (-r) given without using public key encryption

$ gpg2  --sign /tmp/test

$ gpg2 --verify /tmp/test.gpg 
gpg: Signature made Tue 08 Nov 2016 02:13:46 PM BRST using RSA key ID EA3829E3
gpg: Good signature from "Yubikey Test <yubikey@test.org>" [ultimate]

$ rm /tmp/test.gpg 

$ gpg2 -r yubikey@test.org --sign /tmp/test
gpg: WARNING: recipients (-r) given without using public key encryption

$ gpg2 --verify /tmp/test.gpg 
gpg: Signature made Tue 08 Nov 2016 02:14:20 PM BRST using RSA key ID EA3829E3
gpg: Good signature from "Yubikey Test <yubikey@test.org>" [ultimate]

I just found out that it works as I expected if I use the option -u instead of -r. What is the difference of using one or another? I feel that I misunderstood the meaning of recipient, could someone clarify this please? And what this warning means?

4

--recipient or the short -r is used to denote a recipient, which is something only relevant for encryption. GnuPG is warning you that you're not encrypting the messaage.

   --recipient name
   -r     Encrypt  for user id name. If this option or --hidden-recipient is not
          specified, GnuPG asks for the user-id unless --default-recipient
          is given.

If you want to select the key to sign a message, use --local-user or -u. For a message that's only signed, but not encrypted, it does not matter who the recipient is.

   --local-user name
   -u     Use  name as the key to sign with. Note that this option overrides
          --default-key.

This is usually defined in gpg.conf.

If you want to both sign and encrypt a message for yubikey@test.org, apply both commands (add --local-user if necessary):

gpg2 --recipient yubikey@test.org --sign --encrypt /tmp/test

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.