2

I have switched from a YubiKey 4 to a YubiKey 5. Both have the same GPG keys stored. After storing the key on the first YubiKey, I fetched my public key so GPG knows where to look for the private key. Now I cannot fetch the key from the new YubiKey because the public key is already there.

How can I configure GPG so that it will find my private key on the new YubiKey? And, if it's possible, can both YubiKeys configured at the same time so I can use them both?

0

GPG stores files called key stubs that tell it on which card to search for a particular key. I've never seen a way to reference the same key on two different cards, but you should be able to delete the key stubs from your machine (check your gpg home directory) and, with only the new Yubikey inserted, check gpg --card-status to create new stubs that point to that gpg key on the new card.

If you're new to this process it wouldn't hurt to have a backup copy of your gpg directory somewhere before you delete anything.

EDIT: Alternate solutions here might be useful.

  • Thank you, but I cannot find any key stubs. The post you referenced says that the key stubs are stored inside the ".private-keys-v1.d" directory, but this directory is empty at my machine, but GPG still expects the old smartcard / YubiKey. I am using GPG version 2.1.18 on Debian Stretch btw. – Felix Stupp Mar 7 at 14:54
0

I have found a working solution with the help of the other answers.

I removed the "secret keys" (the link to the old YubiKey) with gpg --delete-secret-keys <ID> and then linked GPG to my new YubiKey with gpg --card-status while only the new one is attached. But I think this solution is only working as expected if no secret subkey is stored at the maschine / if all subkeys are managed by the YubiKey.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.