I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am using a Yubikey as a smart card.

GPG shows that the secret key is not available, but there is a signing key on the attached smart card:

$ gpg --list-secret-keys
sec#  rsa4096/0xDEADBEEFDEADBEEF 2000-01-01 [SC]
      Key fingerprint = DEAD BEEF DEAD BEEF DEAD  BEEF DEAD BEEF DEAD BEEF
uid                   [ultimate] My Name <me@example.com>
ssb>  rsa4096/0x8BADF00D8BADF00D 2000-01-01 [E] [expires: 2020-12-31]
ssb>  rsa4096/0xBADDCAFEBADDCAFE 2000-01-01 [S] [expires: 2020-12-31]
ssb>  rsa4096/0xFACEFEEDFACEFEED 2000-01-01 [A] [expires: 2020-12-31]

I can sign a message:

$ echo "test" | gpg --sign --armor
gpg: using "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF" as default secret key for signing
-----BEGIN PGP MESSAGE-----

[snipped signature]
-----END PGP MESSAGE-----

But I cannot --lsign-key:

$ gpg --lsign-key product-security@apple.com

pub  rsa4096/0x782F6D86DED32B71
     created: 2018-08-20  expires: 2019-08-20  usage: SC
     trust: marginal      validity: unknown
sub  rsa4096/0x1C3F44E9CB9F9E3A
     created: 2018-08-20  expires: 2019-08-20  usage: E
[ unknown] (1). Apple Product Security <product-security@apple.com>
[ unknown] (2)  Apple Product Security Notifications <product-security-noreply@lists.apple.com>

Really sign all user IDs? (y/N) y
gpg: using "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF" as default secret key for signing

pub  rsa4096/0x782F6D86DED32B71
     created: 2018-08-20  expires: 2019-08-20  usage: SC
     trust: marginal      validity: unknown
 Primary key fingerprint: 0CD5 C954 D089 2440 1598  9759 782F 6D86 DED3 2B71

     Apple Product Security <product-security@apple.com>
     Apple Product Security Notifications <product-security-noreply@lists.apple.com>

This key is due to expire on 2019-08-20.
Are you sure that you want to sign this key with your
key "My Name <me@example.com>" (0xDEADBEEFDEADBEEF)

The signature will be marked as non-exportable.

Really sign? (y/N) y
gpg: signing failed: No secret key
gpg: signing failed: No secret key

Key not changed so no update needed.

How can I add a signature to this key to validate it?

Signing and key signing is done by different subkeys. You have:

$ gpg --list-secret-keys
sec#  rsa4096/0xDEADBEEFDEADBEEF 2000-01-01 [SC]
      Key fingerprint = DEAD BEEF DEAD BEEF DEAD  BEEF DEAD BEEF DEAD BEEF
uid                   [ultimate] My Name <me@example.com>
ssb>  rsa4096/0x8BADF00D8BADF00D 2000-01-01 [E] [expires: 2020-12-31]
ssb>  rsa4096/0xBADDCAFEBADDCAFE 2000-01-01 [S] [expires: 2020-12-31]
ssb>  rsa4096/0xFACEFEEDFACEFEED 2000-01-01 [A] [expires: 2020-12-31]

Here, DEADBEEF is the key of the whole PGP key, valid for Signing and Certifying.

Then you have three subkeys (ssb = Secret SuBkeys), valid for Encryption, Signing and Authentication respectively (you could eg. have a single subkey valid for both Signing and Authentication, but these are all on different keys for you).

When you gpg --sign, you are using BADDCAFE, whereas for a gpg --lsign-key you would need DEADBEEF. That's why one works while the other doesn't.

Now, I'm not sure why it is failing, it may be that DEADBEEF is not there at all (do you have an offline backup of the full key?), or perhaps it's a bug when interacting with the smartcard, and it is "not finding it", although it is really stored there. An easy thing to review would be the number of slots that are supported by your smartcard, as on some of them you wouldn't even have enough slots for those four keys.

  • You're right, only the three subkeys are on the smartcard, the DEADBEEF key is stored offline. So I guess this just comes down to the usage flags and I need to either bring DEADBEEF in from offline storage to sign the key, or add the C flag to BADDCAFE. I assumed that the Sign flag would also be used for signing keys, but apparently this is the Certify operation. – Ben Dec 6 at 19:52
  • @Ben: Glad it helped. The error message can be a bit surprising if you are not aware of it. Feel free to mark it as answered by hitting the checkmark. I kinda recall it might not be possible to sign other keys using subkeys, but I don't remember the details. – Ángel Dec 6 at 20:00

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.