2

For a new smartcard (crypto stick), I've invoked gpg --card-edit, performed the generate command and selected to not create any backup of the generated keys. After key generation has finished, a %APPDATA%\GnuPG\secring.gpg file has been created and gpg --list-secret-keys gives me following output, no matter whether the smartcard is attached or not:

C:/Users/myaccount/AppData/Roaming/gnupg/secring.gpg
-----------------------------------------------
sec>  2048R/A076E602 2017-03-16
      Card serial no. = 0005 00003547
uid                  My Name <my.email@mydomain>
ssb>  2048R/94D78957 2017-03-16
ssb>  2048R/8C953787 2017-03-16

When removing this file, restarting gpg-agent.exe, reattaching the smartcard without entering the pin, and performing gpg --card-status the same file is recreated.

To me this looks like the secret key is copied over to my harddisk again and again?

1 Answer 1

1

GnuPG stores a key stub, when you interface smart cards. OpenPGP smart cards only contain the raw key data (and key ID), but no user IDs, certifications, settings and other attributes which must be stored locally or fetched from the key server network. Furthermore, this key stub makes GnuPG aware of the card even if it is not plugged in, so it can inquire you to provide it if necessary.

This key stub contains everything but the private keys, which will never leave the card (private key operations are performed by the card instead).

If your keyring is still in the old keyring format (not the new keybox format introduced in GnuPG 2.1 for newly generated keyrings), you can also peak into the keyring using gpg --list-packets C:/Users/myaccount/AppData/Roaming/gnupg/secring.gpg or pgpdump, which provides more flags to specify the output verbosity and can also print the raw key data. Both tools are very technical and require rather intense knowledge of RFC 4880, OpenPGP for understanding the data.

1
  • Thanks for the detailed answer. Now, after giving gpg4win-3 beta a try, there is a new subdirectory private-keys-v1.d which contains 3 .key files. I guess these are also just stubs? Each file has 359 bytes, so enough to store my 2048 bit secret.
    – mstrap
    Commented Mar 17, 2017 at 8:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .