0

I have multiple Yubikeys carrying the same GPG secret key. I want to switch from one Yubikey to anohter one on my laptop. The two obviously have different serial numbers.

After switching the keys when I try to decrypt something (e.g. with pass), I get a popup:

Please insert card with serial number XXXXXXXXXX

(This is with GnuPG version 2.2.17.)

How can I get rid of the popup, telling gpg to ignore whatever the serial number of the smart card is that I used so far, and instead to look for whatever card has the private key that I'm trying to use?

2

Solution

Delete the keygrips of the keys in question from ~/.gnupg/private-keys-v1.d.

You can list the keygrip IDs using gpg --list-secret-keys --with-keygrip.

If all your private keys are on external cards like the Yubikey, you can delete them all using:

rm -r ~/.gnupg/private-keys-v1.d

See here for more information about the private-keys-v1.d directory.


After the deletion of the keygrips, it seems beneficial to run

gpgconf --kill gpg-agent
gpg --card-status

to restart the gpg-agent and reload the card info.

Extra info: What happens when you don't restart/reload (for people who search for these error messages)

If you do only gpgconf --kill gpg-agent, the next decryption may show

gpg: decryption failed: No secret key

Reloading the card info fixes that.

If you do only gpg --card-edit, the next decryption may show

gpg: OpenPGP card not available: No such file or directory

Restarting the agent before that fixes that.

Personally I consider that a bad user experience, ideally GPG would automatically figure that out, but I don't know any technical details about it.

| improve this answer | |
  • Thanks, this helped me a lot. – Noxeus Jan 17 at 10:15
  • 1
    I found out after you delete the private key directory, you only need to run gpg --card-status and everything will work. – zackify Feb 11 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.