14

I have multiple Yubikeys carrying the same GPG secret key. I want to switch from one Yubikey to anohter one on my laptop. The two obviously have different serial numbers.

After switching the keys when I try to decrypt something (e.g. with pass), I get a popup:

Please insert card with serial number XXXXXXXXXX

(This is with GnuPG version 2.2.17.)

How can I get rid of the popup, telling gpg to ignore whatever the serial number of the smart card is that I used so far, and instead to look for whatever card has the private key that I'm trying to use?

Improve this question
1
  • I have this issue on my linux desktop as well. Strangely this all just works how you'd expect on Mac with GPG installed through homebrew.
    – hbogert
    May 5 at 6:56

1 Answer 1

Reset to default
21

Solution

Delete the keygrips of the keys in question from ~/.gnupg/private-keys-v1.d.

You can list the keygrip IDs using gpg --list-secret-keys --with-keygrip.

If all your private keys are on external cards like the Yubikey, you can delete them all using:

rm -r ~/.gnupg/private-keys-v1.d

See here for more information about the private-keys-v1.d directory.

After the deletion of the keygrips, it seems beneficial to run

gpgconf --kill gpg-agent
gpg --card-status

to restart the gpg-agent and reload the card info.

Extra info: What happens when you don't restart/reload (for people who search for these error messages)

If you do only gpgconf --kill gpg-agent, the next decryption may show

gpg: decryption failed: No secret key

Reloading the card info fixes that.

If you do only gpg --card-edit, the next decryption may show

gpg: OpenPGP card not available: No such file or directory

Restarting the agent before that fixes that.

Personally I consider that a bad user experience, ideally GPG would automatically figure that out, but I don't know any technical details about it.

Improve this answer
3
  • 1
    I found out after you delete the private key directory, you only need to run gpg --card-status and everything will work.
    – zackify
    Feb 11, 2020 at 19:42
  • 1
    It looks like this will be fixed a future version of gnupg: dev.gnupg.org/T1983
    – totaam
    Jan 14, 2021 at 5:44
  • When I follow these steps I now get an agent refused operation error.
    – Benjamin Goodacre
    Aug 18, 2022 at 9:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .