As far as I can tell:

  • It is possible to generate a private keyring (i.e. signing private key, plus associated encryption private key and authentication private key) entirely on an OpenPGP Smartcard (i.e. without ever exporting the signing private key from the card), e.g. by using gpg --card-edit, followed by generate.
  • However, it is not possible to generate a revocation certificate for such a signing private key.

Am I correct about this, or is there in fact a way to generate a revocation certificate for a private key that has never been exported from an OpenPGP Smartcard?

  • 2
    I am by no means an expert, but I can't see why you shouldn't be able to create a revocation certificate... from here and here the certificate revokes the public key (which is all others will see) but will be signed with the private key (to prove you created it). So only having the private key on the card shouldn't – as far as I can see – make a difference. – TripeHound Jan 28 at 12:40


It depends upon whether you have access to the public key corresponding to the signing private key.

By default, when you use generate to create a private keyring on an OpenPGP Smartcard with GnuPG, the signing public key will be generated as part of that process and will be automatically added to your user's local keyring-for-public-keys, e.g. ~/.gnupg/pubring.gpg. (From there, you can make backup copies for yourself and/or publish copies to keyservers, to minimise the risk of finding yourself without access to that public key in the future.) With this public key, and the Smartcard, in your possession, yes you can generate a revocation certificate.*

However, if, for any reason, you no longer have access to that public key, then no, you cannot generate a revocation certificate, because:

OpenPGP smart cards do not store enough information to reconstruct a full OpenPGP public key. (Source.)


* In recent versions of GnuPG 2.x (and possibly of GnuPG 1.x - I haven't checked these), if a user uses generate to create a private keyring on an OpenPGP Smartcard, then GnuPG automatically generates a revocation certificate and saves it to a file in the user's ~/.gnupg/openpgp-revocs.d/ directory. (This is in addition to generating the signing public key and adding it to the user's local keyring-for-public-keys as mentioned above.) This is a labour-saving feature: assuming that you would otherwise generate a revocation certificate manually, if creating a new private keyring, it spares you from having to do that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.