3

I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors:

x>gpg -vv --decrypt encrypted.gpg
gpg: armor: BEGIN PGP MESSAGE
# off=0 ctb=XX tag=1 hlen=3 plen=XXX
:pubkey enc packet: version 3, algo 1, keyid XXXX5753679AAAAA
        data: [4096 bits]
gpg: public key is XXXX5753679AAAAA
# off=XXX ctb=XX tag=1 hlen=3 plen=XXX
:pubkey enc packet: version 3, algo 1, keyid XXXX05D83EFAAAAA
        data: [4096 bits]
gpg: public key is XXXX05D83EFAAAAA
gpg: using subkey XXXX05D83EFAAAAA instead of primary key XXXXXXXXXXXXXXXX
# off=XXXX ctb=XX tag=XX hlen=2 plen=0 partial new-ctb
:encrypted data packet:
        length: unknown
        mdc_method: 2
gpg: using subkey XXXX05D83EFAAAAA instead of primary key XXXXXXXXXXXXXXXX
gpg: encrypted with 4096-bit RSA key, ID XXXX05D83EFAAAAA, created 2018-XX-XX
      "x (Personal Key) <x@gmail.com>"
gpg: public key decryption failed: Invalid ID
gpg: using subkey XXXX5753679AAAAA instead of primary key XXXXXXXXXXXXXXXX
gpg: encrypted with 4096-bit RSA key, ID XXXX5753679AAAAA, created 2018-XX-XX
      "y <y@gmail.com>"
gpg: decryption failed: No secret key

To make sure my smartcard was being detected, I ran gpg --card-status, which worked, and I saw the same ID in the output. Anyone know why I can't decrypt using my yubikey? Thanks.

Also, I ran gpg --list-secret-keys:

x>gpg --list-secret-keys
C:/Users/x/AppData/Roaming/gnupg/pubring.kbx
--------------------------------------------------
sec>  rsa4096 2018-xx-xx [SC] [expires: 2019-xx-xx]
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      Card serial no. = 000X 0XXXXXXX
uid           [ultimate] x (Personal Key) <x@gmail.com>
ssb>  rsa4096 2018-xx-xx [E] [expires: 2019-xx-xx]
ssb>  rsa4096 2018-xx-xx [SEA] [expires: 2019-xx-xx]

The thing is, I don't have the second secret key, only the first. The issue seems to be "public key decryption failed: Invalid ID" (the secret key of this public key is on my smartcard).

5
  • Can you provide the verion of GnuPG that you're working? Also, check this discussion that's pretty similar. – mike Oct 26 '18 at 13:21
  • @MikeM. gpg (GnuPG) 2.2.10 libgcrypt 1.8.3 – Rob Gates Oct 26 '18 at 14:01
  • @MikeM. Also, before posting I researched a ton and found a few references, but no solutions. – Rob Gates Oct 26 '18 at 14:03
  • 1
    Unfortunately, I can't really reproduce the problem without the specific product. Did you check this? It's the most relevant information I can find. – mike Oct 26 '18 at 23:26
  • Have you successfully decrypted a file using this particular Yubikey/computer before? I once had an issue that arose from key handles pointing to my backup smartcard when I tried using my primary. --card-status looked fine but the key handle wouldn't update until I deleted it outright and checked the card again. – user8675309 Oct 29 '18 at 17:22
2

I just ran into this problem today. I still have no idea what causes it, but I can reproduce it every time. I have gotten it to work consistently by doing the following:

  1. plug in the yubikey
  2. run gpg --card-edit
  3. at the prompt type "verify" (and enter the password to unlock the card)
  4. Quit out of gpg card edit, and then I am able to decrypt files as normal.

I am still looking for a less manual solution but this has been working for now.

1
  • i switched off forced Signature PIN in: gpg --edit-card -> admin -> forcesig. This seems to be the issue somehow. – anton Jan 13 at 4:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.