6

I have a YubiKey NEO on which I have the OpenPGP applet and I have a PGP key installed. I work on 3 different computers and I initialized the card on computer bob. I'm now at computer rob. Someone sent me an encrypted file, so I put in my YubiKey NEO and ran gpg --decrypt.

I got the following output:

gpg: encrypted with RSA key, ID DEADBEEF
gpg: decryption failed: secret key not available

Okay, so maybe I need to install my PGP public key here. I did that, and then got:

gpg: decryption failed: secret key not available

I then SSH'd into bob from rob and ran gpg --list-secret-keys and lo-and-behold:

sec>  2048R/DEADDEAD 2015-02-31
      Card serial no. = 0000 12345678
uid                  Naftuli Tzvi Kay <[email protected]>
ssb>  2048R/BEEFBEEF 2015-02-31
ssb>  2048R/DEADBEEF 2015-02-31

What in the heck? I copied this "key" over from bob to rob and now things work, and yet I still need to enter my PIN for my PGP key.

When I created the key, I never imported it to disk so it should only exist on the card. Why does a secret key exist on disk(!) if the secret key isn't supposed to be anywhere but the smart card?

Improve this question

1 Answer 1

Reset to default
5

This is not actually the secret key, but a kind of stub referencing the one on your card. This stub contains pretty much all "metadata" of your private key (including the public key belonging to it), but the actual private key is only stored on your card (and never leaves it).

This is important, as the card only stores the actual key (and performs basic cryptographic operations with those), but not other meta information like creation date, usage flags, user IDs etc.

(Reading up the specifications again, I realized this was wrong. The cards store the key's fingerprint and creation time.)

This key stub helps GnuPG managing the keys, and lets it look for a card / ask for the card if necessary. As the fingerprint of the public key is stored on the card, the private "stub" key can be easily regenerated if the public key is available. GnuPG makes this easy by running the fetch command in the --card-edit menu, which queries the key server network for the public key.

Improve this answer
8
  • 1
    So I need this "key" to access my smart card PGP key on every computer I access, right? Is there a way to regenerate this "key" if I have to start work on a new computer without access to the old one?
    – Naftuli Kay
    Mar 31, 2015 at 22:46
  • 2
    I just realized I was wrong. Looking up the specs again, I learned the card does indeed store the public key's fingerprint and thus is able to query key servers for the public key and create a new stub key. I corrected the answer and already included some words to your follow-up question.
    – Jens Erat
    Mar 31, 2015 at 23:18
  • 2
    Thanks for looking into it! Let's say worst case scenario, I'm on a new computer with no internet access and my PGP key. Can I extract everything I need from the card?
    – Naftuli Kay
    Apr 1, 2015 at 6:10
  • You can easily try out (that's what I did) by setting the --homedir parameter of gpg to some temporary folder. Yes, it works, at least if the public key is available on key servers.
    – Jens Erat
    Apr 1, 2015 at 7:20
  • My main concern is: what if it isn't on key servers or I don't have network access?
    – Naftuli Kay
    Apr 1, 2015 at 17:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .