I am currently using a Yubikey 4 with my PGP subkeys on it. My mainkey is stored within Kleopatra.

As I am planning to move over to a new Yubikey 5 I have asked myself if it is possible to still be able to decrypt emails with my new pair of subkeys generated for the new Yubikey?

2 Answers 2


The important question is how you generated your PGP key and subkeys.

As explained in the docs there are two ways:

  • Generating Keys externally from the YubiKey (Recommended)
  • Generating Your PGP Key directly on Your YubiKey

The first approach is recommended. You can use a live distro such as Tails to generate your keys on an airgapped (without networking) computer. Then you make backups of your keys to removable storage like a USB key or a hard drive, that you keep in a secure place.

The other option is to generate the keys directly on the device. This is very secure but the major drawback is that you cannot backup the keys. If you lose or destroy the device you lose your keys. With this approach, migration is not possible. This option should be avoided unless you know that your key is going to have a limited shelf life.

So if you chose option #1, it is quite easy. You don't need the old YubiKey. Start your live distro, reimport your private keys from the external storage, and you write them to the new YubiKey with the keytocard command.

To answer the question: in order to retain access to your mails you must keep the current key (and subkeys). But the hardware itself does not have to stay the same, it could be another YubiKey or a smart card as long as you have that external backup.

If you really must change your PGP key: in theory you could decrypt files and reencrypt them with a new key, But with E-mails this is complicated. They are probably stored in a mbox or pst file. Even if they are available as standalone files (on an IMAP server for instance), it's not the whole file that is encrypted but the mail body. The headers are still in clear. AFAIK PGP cannot just decrypt the encrypted part while keeping the rest of the file intact. There is no easy solution I'm afraid.

However, I did a test with Thunderbird. I chose an encrypted message, selected the whole message source (Ctrl-U) and copied it to a file. Then using gpg -d <the file> from the command line I was able to read the mail after entering the passphrase. But you don't have the headers and all that. What you get is a stripped-down version. It's not something that you could reinject to the mbox file for instance.

  • Hello Anonymous, I have done a mixture of creating keys. Mainkey & encryption subkey withing Kleopatra on Windows Authentication & verification on Yubikey directly. I guess the most important key (encryption and main) are good to go for my new key. Commented Apr 1, 2020 at 20:21
  • Maybe there is hope. Can you add the output of gpg2 --expert --list-secret-keys your_key to your question, where your_key is your key ID or associated E-mail ? This should list your subkeys and whether they are stored externally (indicated by the > sign). You probably have 3 subkeys: signing (S), encryption (E) and authentication (A). For more security all subkeys should reside on the Yubikey though. Keeping the primary (certification) key on your PC somewhat defeats the purpose of the Yubikey.
    – Kate
    Commented Apr 1, 2020 at 20:50
  • All my subkeys are stored on Yubikey indicated with the > sign. Might it work to revoke those keys afterwards and create new keys which I put on my new Yubikey? Regarding the primary key for certification: I know that this storing on the pc is not the best solution but I will keep it until I have my new Yubikey. But I already stored it on an encrypted container which I put on an external drive. Commented Apr 2, 2020 at 9:15
  • Creating new keys will not help. You need the current keys to read your mails. Sounds like you are out of luck here. The important lesson is, have backups of your keys and for this you have to generate them externally. You can still get a new Yubikey and generate new keys that you will use from now on. But in order to access past E-mails you will need the old device. If you have some important mails, you could archive the plain text contents after decryption. Then backup or re-encrypt.
    – Kate
    Commented Apr 2, 2020 at 12:27
  • Okay thanks - so the best approach would be: 1) Generate mainkey, generate all subkeys externally. 2) Backup everything on an encrypted external media. 3) Subkeys keytocard on Yubikey Is that right? Commented Apr 2, 2020 at 12:41

If you have the key outside Yubikey, just import them using gpg --edit-card and keytocard. If the keys are only available in Yubikey, they can't be exported.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .