4

I'm trying to decrypt a file that was signed with my ssb key stored on my Yubikey, but I get the following errors:

x>gpg -vv --decrypt encrypted.gpg
gpg: armor: BEGIN PGP MESSAGE
# off=0 ctb=XX tag=1 hlen=3 plen=XXX
:pubkey enc packet: version 3, algo 1, keyid XXXX5753679AAAAA
        data: [4096 bits]
gpg: public key is XXXX5753679AAAAA
# off=XXX ctb=XX tag=1 hlen=3 plen=XXX
:pubkey enc packet: version 3, algo 1, keyid XXXX05D83EFAAAAA
        data: [4096 bits]
gpg: public key is XXXX05D83EFAAAAA
gpg: using subkey XXXX05D83EFAAAAA instead of primary key XXXXXXXXXXXXXXXX
# off=XXXX ctb=XX tag=XX hlen=2 plen=0 partial new-ctb
:encrypted data packet:
        length: unknown
        mdc_method: 2
gpg: using subkey XXXX05D83EFAAAAA instead of primary key XXXXXXXXXXXXXXXX
gpg: encrypted with 4096-bit RSA key, ID XXXX05D83EFAAAAA, created 2018-XX-XX
      "x (Personal Key) <[email protected]>"
gpg: public key decryption failed: Invalid ID
gpg: using subkey XXXX5753679AAAAA instead of primary key XXXXXXXXXXXXXXXX
gpg: encrypted with 4096-bit RSA key, ID XXXX5753679AAAAA, created 2018-XX-XX
      "y <[email protected]>"
gpg: decryption failed: No secret key

To make sure my smartcard was being detected, I ran gpg --card-status, which worked, and I saw the same ID in the output. Anyone know why I can't decrypt using my yubikey? Thanks.

Also, I ran gpg --list-secret-keys:

x>gpg --list-secret-keys
C:/Users/x/AppData/Roaming/gnupg/pubring.kbx
--------------------------------------------------
sec>  rsa4096 2018-xx-xx [SC] [expires: 2019-xx-xx]
      XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      Card serial no. = 000X 0XXXXXXX
uid           [ultimate] x (Personal Key) <[email protected]>
ssb>  rsa4096 2018-xx-xx [E] [expires: 2019-xx-xx]
ssb>  rsa4096 2018-xx-xx [SEA] [expires: 2019-xx-xx]

The thing is, I don't have the second secret key, only the first. The issue seems to be "public key decryption failed: Invalid ID" (the secret key of this public key is on my smartcard).

5
  • Can you provide the verion of GnuPG that you're working? Also, check this discussion that's pretty similar.
    – mike
    Oct 26, 2018 at 13:21
  • @MikeM. gpg (GnuPG) 2.2.10 libgcrypt 1.8.3
    – Rob Gates
    Oct 26, 2018 at 14:01
  • @MikeM. Also, before posting I researched a ton and found a few references, but no solutions.
    – Rob Gates
    Oct 26, 2018 at 14:03
  • 1
    Unfortunately, I can't really reproduce the problem without the specific product. Did you check this? It's the most relevant information I can find.
    – mike
    Oct 26, 2018 at 23:26
  • Have you successfully decrypted a file using this particular Yubikey/computer before? I once had an issue that arose from key handles pointing to my backup smartcard when I tried using my primary. --card-status looked fine but the key handle wouldn't update until I deleted it outright and checked the card again. Oct 29, 2018 at 17:22

1 Answer 1

3

I just ran into this problem today. I still have no idea what causes it, but I can reproduce it every time. I have gotten it to work consistently by doing the following:

  1. plug in the yubikey
  2. run gpg --card-edit
  3. at the prompt type "verify" (and enter the password to unlock the card)
  4. Quit out of gpg card edit, and then I am able to decrypt files as normal.

I am still looking for a less manual solution but this has been working for now.

1
  • i switched off forced Signature PIN in: gpg --edit-card -> admin -> forcesig. This seems to be the issue somehow.
    – anton
    Jan 13, 2021 at 4:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .