0

Based on Is it possible to export a GPG subkey's public component? I got familiar with:

gpg --keyid-format long --with-fingerprint --list-key {e-mail}
gpg --export --armor --output public-key.asc 633DBBC0! # for ssb1

and

gpg --export-options export-minimal {key-id}

I also found the following which I added to my gpg.conf.

list-options show-unusable-subkeys

In the context of a Yubikey, I sometimes need to transfer public key components to a new key ring on a new system in order to decrypt an old file. For some reason gpg --card-status is not enough to get the ball rolling. Gpg will keep reporting that no key exist to decrypt the file. After importing the public key component, it works. I read somewhere on Stack that "the yubikey has not enough data on it to recontruct the public key component." (Might add source later).

However, I don't want to export all old subkeys (hence keyid!), only a select few and I don't want to export any signatures (hence export-minimal).

So this is what I tried, but did not result in a desired result:

gpg --armor --export --export-options export-minimal {subkeyid1}! {subkeyid2!}
or
gpg --armor --export --export-options export-minimal {subkeyid1}!
gpg --armor --export --export-options export-minimal {subkeyid2}!

If I pick one {subkeyx}!, the output is the same. The combination of export-minimal and pointing to a subkey is not working as far as I can tell. I don't know of any switch I can put in front of keyid, do you?

Then I tried the following and merged them later:

gpg --armor --export --output file1.asc {subkeyid1}!
gpg --armor --export --output file2.asc {subkeyid2}!

But these public key components contain unwanted signatures (and their primary key public part and uid which is acceptable).

I used gpg --armor --export {subkeyid2}! | gpg for reading the output. If I do this with unexpired subkeys, I get an expected result of keys, but if I do this with expired subkeys, the subkey is not listed.

The question: So, how do I export two expired subkeys's public key components without any signatures?


(Sidenote; meta question; alternative route):

One beauty of a yubikey is facilitating the portability of private key material. I don't want to use a public keyserver for the public key material. If anyone has any ideas what can facilitate the public key portability, I am all ears.

gpg --card-status delivers:

[...]
General key info..: sub {rsaX/eccX}/{keyid} {date} {name} {address}
sec# {rsaX/eccX}/{keyid} {created date} {expires date}
[...]
ssb> {rsaX/eccX}/{subkeyid1} {created date} {expires date}
card-no: {nr}
ssb> {rsaX/eccX}/{subkeyid2} {created date} {expires date}
card-no: {nr}

And as we now from gpg -k and gpg -K. 'sub' means public subkey; 'ssb' means private subkey and the '>' indicator means material is on smartcard. So this all seems to confirm the public material is not on the card.

Could I put public keys on a backup slot on the Yubikey? How do you get a copy out later?

1

While not explicitly stated, apparently --export-minimal drops expired subkeys, which make sense.

The option you need is probably self-sigs-only. However, that is a filter only for import. We would need to use an intermediate keyring for that

TEMPORARY_KEYRING=`mktemp -d --tmpdir`
gpg --armor --export keyid | GNUPGHOME="$TEMPORARY_KEYRING" gpg --import --import-options self-sigs-only

# We can check it imported what you wanted with
GNUPGHOME="$TEMPORARY_KEYRING" gpg --list-keys --list-options show-unusable-subkeys

# Then you simply export it
GNUPGHOME="$TEMPORARY_KEYRING" gpg --armor --export

Other options include:

  • Faking the current time:
faketime 'time-when-subkey-was-valid' gpg --armor --export --export-options export-minimal subkeyid
  • Manually fetching the required pieces
gpg --export keyid | gpgsplit

# Manually inspect the created files and remove all the .sig not from your own master key
# Generate the new key file with just the bits you want
cat 00* > mykey.gpg
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.