I created a number of profiles with separate subkeys for authentication, signature, and encryption while primary keys are saved on USB Stick. It's working alright but I was wondering if there are some good methods to link to a primary key when it is needed to certify certain operations, such as signing another key, adding identities etc.

I followed this blog, which I thought would be a solution. I imported private keys into a temp gpg directory ~/ram/gpgtmp/ and tried to sign ID2 with ID1 both in a default folder ~/.gnupg/puring.kbx.

gpg --homdir ~/ram/gpgtmp --keyring ~/.gnupg/pubring.kbx -u ID1 --edit-key ID2

The ID2 is not signed in a default gnupg folder but in ~/ram/gpgtmp. I tested it when invoking command gpg --homedir ~/ram/gpgtmp -k. Therefore it is not necessarily working.

Do you know how to bring an offline primary key?


I have found a way to link an offline primary key. Still, inspired by a blog Using an offline GnuPG master key, I realised that --keyring adds a file to a list of keyrings, whereas I needed to specify exactly one file. Therefore, the missing option was --no-default-keyring. I am not an expert but this is what worked for me:

1) Mount USB stick. The folder will something like /run/media/username/CORSAIR in Linux.

2) Create directory for a ram disk

mkdir ~/ram

3) Mount the ram disk:

sudo mount -t tmpfs -o size=64M tmpfs ~/ram

4) Create a temporary directory for gpg: mkdir ~/ram/gpgtmp.

5) Import private keys from a USB to a temp gpg , e.g.

gpg --homedir ~/ram/gpgtmp --import /run/media/username/CORSAIR/gpg-archive/primary-keys.asc

After importing private keys to ram disk, USB stick is no longer needed.

6) Run GPG editor:

gpg --homedir ~/ram/gpgtmp/ --keyring ~/.gnupg/pubring.kbx --no-default-keyring -u <ID1> --edit-key <ID2>

7) In the editor, use uid n to choose an identity of interest, followed by sign to sign selected identity with a local key .

With a primary key linked to a temp gpg folder, the command should be completed with success. As a side note, after step 5 a USB stick is no longer reuqired and can be dismounted.


In case of error:

gpg: key AAAAAAAAAAAAA: error sending to agent: No such file or directory

try to restart gpg-agent

gpgconf --kill gpg-agent
gpgconf --launch gpg-agent

I also deleted everything in gpgtmp. Even better would be to re-create the folder. After re-launching the gpg-agent, the import was working again. I guess a simple restart system would also work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.