I'm having an issue with Enigmail. Here's an example to highlight my problem.
Alice and Bob wish to communicate securely using Enigmail. For extra security, they both decide to create keys using the --expert flag, and make their primary keys have only the certifying capability. Alice and Bob then each generate two subkeys--one for signing, and one for encryption. Finally, Alice and Bob remove the primary secret key from the secret keyring and record the key to external media for safekeeping. The way I see it, Alice and Bob now each have five keys, or 2 and 1/2 keypairs.
- Primary Public Key
- Public Encryption Subkey
- Public Signing Subkey
- Secret Encryption Subkey
- Secret Signing Subkey
- ~~(MISSING) Primary Secret Key~~
There are many questions around stackexchange that explain why one might wish to manage their keys this way, this post in particular.
Anyhow, whenever Alice attempts to send an email using Enigmail to Bob, Enigmail complains "Key not found or not valid. The (sub-)key might have expired." All the keys I generated do not expire.
I think Enigmail is assuming Alice's primary secret key is to be used for signing, and sending the email fails when it attempts to use a key which does not exist. As I've explained, not only is Alice's primary secret key missing, but it also does not have the capability of signing. However, the subkeys are present. Is it possible to make Enigmail use the subkeys?