I have an OpenPGP key on a smart card that I've used for some time. I now wish to add some additional email-addresses to the key. So I insert my card into the reader and execute gpg2 --edit-key for my key followed by adduid. Everything works as intended until I confirm the operation. It then reports

gpg: secret key parts are not available gpg: signing failed: Unusable secret key

I get this output with and without the smart card attached to my system,.

So I got a few questions:

  • How can I add emails to my key on card without breaking any previous signatures?
  • Is that a safe thing to do?
  • Do I need to download the key to a safe machine to do the edit there?
  • I assume I'll need to redistribute my public key after adding the uid. Does that mean that others need to sign my public key again?

EDIT: Changed formatting to make the output of gpg more clear. Also changed some grammar.

EDIT2: This is what GPG says to other commands:

gpg -K

sec#  2048R/A62B19E0 2016-06-01
uid                  My Name <mymail>
ssb>  2048R/B93264B8 2016-06-01
ssb>  2048R/D252B29D 2016-06-01
ssb>  2048R/431513E0 2016-06-01
ssb#  2048R/594CAEC2 2016-06-01

gpg --card-status

General key info..: sub  2048R/B93264B8 2016-06-01 My Name <mymail>
sec#  2048R/A62B19E0  created: 2016-06-01  expires: never     
ssb>  2048R/B93264B8  created: 2016-06-01  expires: never     
                      card-no: 0005 00004899
ssb>  2048R/D252B29D  created: 2016-06-01  expires: never     
                      card-no: 0005 00004899
ssb>  2048R/431513E0  created: 2016-06-01  expires: never     
                      card-no: 0005 00004899
ssb#  2048R/594CAEC2  created: 2016-06-01  expires: never  
  • What do you mean by: parts of the secret key are missing? Either in a file or on a smart card, the keypair would be just present. Also, it may be better to post the exact output you get, otherwise people are simply guessing what GPG is doing. – grochmal Nov 24 '16 at 0:47
  • @grochmal well, parts of the secret key are missing is the exact output of gpg. I'll edit the question to make that more clear. – jko Nov 24 '16 at 10:05
  • 1
    What's the output of gpg -K, gpg --card-status? Is it possible you only stored the subkeys on the card? You don't really add user IDs to the card, but to the public key (which is not stored on the card at all). The ID is signed by the primary private key, which might be on the card and cannot be located by GnuPG, at least that's what the error message says. – Jens Erat Nov 24 '16 at 18:13
  • @JensErat I've added the output of the commands you requested. – jko Nov 24 '16 at 18:34
  • Eyup, sec# means that the main secret key is simply not there. It was either removed or the export was made without it. You can''t add UIDs or extra keys to the keychain without that key. – grochmal Nov 24 '16 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.