2

I have 2 YubiKeys and want one of them to be a backup. So let's say I generated a key $KEY in my computer with an encryption subkey. I need to export the secret keys, because when moving them to the card they disappear, and then reimport them.

So I export them with

gpg2 -a -o secmain.asc --export-secret-key --armor $KEY
gpg2 -a -o secsub.asc --export-secret-subkeys --armor $KEY

move them to the card, and then re-import them with:

gpg2 --import secmain.asc
gpg2 --import secsub.asc

I would expect this to work (as this is what was in the tutorial I read), but on the second import GPG tells me that the key was not changed, so I don't have my encryption key back. After searching a bit I found out about the --export-secret-keys option, which I assumed would export main and all sub keys in one package, but on import encryption subkey is still missing.

How can this be done?

EDIT

After further discussions, I tried to generate default keys and those I can correctly import/export. Then I the keys with my preferred settings manually and they also imported well. So it turns out this issue only occurs when I generate a key using this command:

gpg2 --batch --gen-key <<EOF
Key-Type: EdDSA
Key-Curve: ed25519
Key-Usage: sign
Subkey-Type: ECC
Subkey-Curve: Ed25519
Subkey-Usage: encrypt
Name-Real: My Name
Name-Comment: uname
Name-Email: [email protected]
Expire-Date: 0
EOF

What gives? What's wrong here, and if it is, why isn't there a warning?

Improve this question

1 Answer 1

Reset to default
2

GPG tells me that the key was not changed

That is because the the secret subkeys should already be imported with the first command. You can verify with gpg --list-packets secmain.asc that the full key was exported.

The output generated by --export-secret-subkeys is superfluous (and will contain an unusable primary secret key).

on import encryption subkey is still missing

Check the output of gpg --list-secret-keys

EDIT

What's wrong here

I would suspect this:

Subkey-Curve: Ed25519

... being combined with this:

Subkey-Usage: encrypt

I'm not sure how gpg handles this internally, since there is no way to create an "ed25519" encryption key using interactive mode. If you instead use Subkey-Curve cv25519 the key should export and import without issue.

Improve this answer
17
  • gpg --list-packets secmain.ascc indeed contains data of a subkey, however upon importing the encryption key is not marked as ssb but ssb# and I cannot perform any operations with it with gpg complaining about it being unusable. Furthermore, if I try to repeat the operation to move the key to card, I end up with no key in the card.
    – Olivetree
    Apr 14, 2021 at 21:52
  • The # is a pointer indicating the key is on a card. Check the output of gpg --list-packets secmain.asc - do you see a line with gnu-divert-to-card in the secret subkey area?
    – fuzzydrawrings
    Apr 14, 2021 at 22:13
  • No such string there. Also: 1) I export the key before I move it to the card. How would it know I would move it there? 2) I did rm -r .gnupg before import with the same results 3) I thought it was > that meant it was on the card
    – Olivetree
    Apr 14, 2021 at 22:17
  • You are correct > is the pointer, not #. The hashtag usually means the key is expired or has been revoked. Are either of these the case?
    – fuzzydrawrings
    Apr 14, 2021 at 22:26
  • Nope :/ they were created with no expiration date (and why would it expire only after import?) and I don't even know how to revoke keys. I don't intend to use PKI, I just want to encrypt stuff with my Yubikey and have a spare.
    – Olivetree
    Apr 14, 2021 at 22:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .