11

I was trying to encrypt a file using a GPG public key.

It's working fine on my test server which is ubuntu 18.04 but when I try to use the same key on my production server (Amazon Linux) it failed to encrypt with a message

gpg: 40BXFE61: skipped: Unusable public key

There are other keys that are working fine, having problem with this key only.

I've already tried by trusting the keys (ultimate) and having expiry (Never).

Any suggestion or advice?

Thanks

1
  • 1
    Please run the command you were trying to run using gpg -v --debug lookup flags. This should help identify the issue better. My guess is that the key does not have a flag set to allow it being used for encryption. Can you sign a file with it?
    – user163495
    Oct 9, 2019 at 11:45

4 Answers 4

10

It is possible that your key/subkey has expired.
Try gpg --edit-key <keyID>
This will show you the expiry of the individual primary and sub keys. If one of them has expired ,

  1. either create a new key (recommended for security)
    or
    2. renew its expiry date.
    This link will help in renewing. https://sites.lafayette.edu/newquisk/archives/504
7

My guess would be that you are trying to use an ECC key (or subkey). The version of gnupg that comes with Amazon Linux is too old to support ECC cryptography. If you look at the output of gpg --list-key 40BXFE61, you can check for any pub or sub entries that have cv25519 or nistp256 in them, e.g.:

pub   rsa4096/E63EDCA9329DD07E 2011-11-07 [SC]
      DE0E66E32F1FDD0902666B96E63EDCA9329DD07E
uid                 [ultimate] Konstantin Ryabitsev <[email protected]>
sub   rsa4096/0BED129D9916360E 2015-11-02 [A]
sub   ed25519/B6C41CE35664996C 2018-02-09 [S]
sub   cv25519/86D203575A83079D 2018-05-02 [E]
sub   rsa2048/3FF293496E43D963 2018-05-02 [A]

GnuPG 2.0 and earlier only have support for RSA/DSA keys. Unfortunately, there isn't much you can do to support ECC keys on Amazon Linux, short of building gnupg-2.2+ on your own.

2

I experienced this issue when the Trust got somehow wrongly set.

To correct in Ubuntu, I used Passwords and Keys application and set Override owner trust to Ultimate

Alternatively from the command line:

gpg --list-key

In the output identify the key's finger print, e.g. '7DD2204B5F2845832E588C33FAC3EB3BF321572E' and set the trust with:

echo '7DD2204B5F2845832E588C33FAC3EB3BF321572E:6:' | gpg --import-ownertrust

(i.e. to the fingerprint append ':6:' which identifies the level of the trust)

1

I ran these commands on the openSUSE terminal to view and renew my GPG keys:

gpg --list-keys
gpg --edit-key "key id from the previous command"
expire
save
2
  • 1
    Welcome to the community. Ugh, how do you renew the keys this way? Feb 19 at 21:08
  • @SirMuffington I just renewed the expiration date by typing the above commands and following the prompts. The prompts were quite clear to me :)
    – Megidd
    Feb 20 at 3:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .