32

When trying to encrypt files, I get the following error in KGpg editor window:

The encryption failed with error code 2

On the command line I get:

$ gpg --list-keys
/home/user/.gnupg/pubring.gpg
 ---------------------------------
pub   2048D/5E04B919 2012-02-02 [expires: 2016-02-01]
uid                  Firstname Lastname <email.address@domain.com>
uid                  [jpeg image of size 4005]

$ 
$ gpg --encrypt file-to-encrypt
You did not specify a user ID. (you may use "-r")

Current recipients:

Enter the user ID.  End with an empty line: email.address@domain.com
No such user ID.

This used to work both with editor and on the command line with the same key. The Current recipients: is empty. Why is that?

UPDATE:

When trying to specify the user ID on the command line using the -r option, I get the following:

$ gpg -r email.address@domain.com --encrypt file-to-encrypt
gpg: email.address@domain.com: skipped: unusable public key
gpg: file-to-encrypt: encryption failed: unusable public key

Info:

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 12.10
Release:        12.10
Codename:       quantal

$ dpkg -s gnupg
Package: gnupg
Status: install ok installed
Priority: important
Section: utils
Installed-Size: 1936
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Architecture: amd64
Multi-Arch: foreign
Version: 1.4.11-3ubuntu4.4
35

I figured out what the problem and solution was so I give an answer with details should anyone run into the same problem, it may be helpful.

The problem is somewhat ambiguous, no really informative error message is given.

It turned out that the encryption sub-key was expired. Strangely, gpg --list-keys did NOT show the expired sub-key!! Once the sub-key expiry was extended, it was included in the output of gpg --list-keys.

Also, KGpg does not show in any way that the sub-key is expired nor it allows to extend the expiry of the sub-key (only the main key's expiry can be changed).

The output of gpg --list-keys before the solution (I changed personal details):

$ gpg --list-keys
/home/user/.gnupg/pubring.gpg
---------------------------------
pub   2048D/5E04B919 2012-02-02 [expires: 2016-02-01]
uid                  Firstname Lastname <email.address@domain.com>
uid                  [jpeg image of size 4005]

Nothing more.

However, gpg --edit 5E04B919 showed that the sub-key is expired

$ gpg --edit 16AE78C5
gpg (GnuPG) 1.4.11; Copyright (C) 2010 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Secret key is available.

pub  2048D/5E04B919  created: 2012-02-02  expires: 2016-02-01  usage: SCA 
                     trust: ultimate      validity: ultimate
sub  1024g/16AE78C5  created: 2012-02-02  expired: 2014-02-01  usage: E   
[ultimate] (1). Firstname Lastname <email.address@domain.com>
[ultimate] (2)  [jpeg image of size 4005]

gpg>

After some Google search, I found this mailing list archive which pointed me to the right direction to extend the expiry of the sub-key using gpg command line:

http://lists.gnupg.org/pipermail/gnupg-users/2005-June/026063.html

I followed the instructions and extended the sub-key expiry. After this gpg --list-keys gave a different output:

$ gpg --list-keys
/home/user/.gnupg/pubring.gpg
---------------------------------
pub   2048D/5E04B919 2012-02-02 [expires: 2016-03-12]
uid                  Firstname Lastname <email.address@domain.com>
uid                  [jpeg image of size 4005]
sub   1024g/16AE78C5 2012-02-02 [expires: 2016-03-12]

After this, everything was back to normal, I could encrypt files, etc.

  • 2
    Latest gpg tool allows --edit-key. and the way to do it is interactively within the gpg tool, gpg> key 1 . then gpg> expire then follow the prompts. – Cheeso Nov 22 '17 at 22:27
6

In my case I imported my key (gpg --import path/to/key) generated on other machine.

But I could not use it because it was untrusted.

I executed gpg --edit-key "MY KEY ID" trust and set up trust level 5.

After that my key became trusted and now I can use it for encryption.

  • I think your case is quite unrelated to the situation when a trusted and valid key has an expired encryption sub-key. You were probably only dealing with a valid key which has not been set as trusted in your particular keychain. Nevertheless, thanks for the info. – marekful Mar 4 '17 at 1:09
  • 4
    Yes, it's unrelated to your particular case but this question was the first result when I searched the web for solution for my issue so I added answer here to help others. – mixel Mar 4 '17 at 1:24
2

You need to specify the key that you want to use for encryption, so the command you need in this case is gpg -r email.address@domain.com --encrypt file-to-encrypt.

  • Thanks Tim, please see my update. Like I said, encryption with the same key did work some time ago. Any idea why the public key rendered unusable? – marekful Mar 13 '14 at 12:17
  • Hmmm, what is the key type? The output of gpg --list-keys looks like it doesn't include an encryption subkey in the ring, so that's probably your problem. (It looks like you just have a DSA key, which is used for signing only). Did you do an export/import of keys recently? – Tim Lamballais Mar 13 '14 at 12:33
  • What is the output opf gpg --edit-key 5E04B919? – Tim Lamballais Mar 13 '14 at 12:36
  • Thanks for input Tim. It turned out the sub-key was expired. Strangely, gpg --list-keys did NOT show the expired sub-key!! (I still have the output on my console.) Once the sub-key expiry was extended, it was included in the output of gpg --list-keys. Also, KGpg does not show this nor it allows to extend the expiry of the sub-key (only the main key's expiry can be edited). – marekful Mar 13 '14 at 15:18
1

I faced the same problem (expired public key) and came across this thread. The solution suggested marekful, although very useful, only works if you have access to the (corresponding) secret key.

Since in my case this precondition did not hold, I eventually went ahead and changed my system time to an earlier date (when the key was still valid). This resulted in a avoiding the skipped: unusable public key message.

I am aware that it is not a good practice to use expired keys. Use this as a last resort if the situation absolutely demands it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.