Re: [Bug] OpenPGP-Applet, PGP-keys won't sign other keys

2015-09-01T08:44:56+01:00

Key signing is carried out using the certifying key (the C flag in the type field), which is your main key, not the signing subkey. Your gpg --card-status shows 'sec#', indicating the main secret key is offline, so GnuPG is correctly reporting that the secret key needed for the key signing operation is unavailable.

You might be able to force key signing using the signing subkey (don't forget to put a ! after the key ID in this case), but this is not standard practice as revocation of the signing subkey would invalidate the signature and it goes against the type flags in your key.

Statistics: Posted by DavidW — Tue Sep 01, 2015 8:44 am

[Bug] OpenPGP-Applet, PGP-keys won't sign other keys

2015-08-24T08:31:44+01:00

Hi,

I use the Yubikey Neo primarily for signing and encrypting files. But when I tried to sign another users GPG-key, gpg fails:

This is my GPG-Agent-Version:

Code:

rince@russet ~ $ LANG=C gpg-agent --version
gpg-agent (GnuPG) 2.0.22
libgcrypt 1.5.3

This is my Yubikey NEO:

Code:

rince@russet ~ $ LANG=C gpg --card-status
Application ID ...: D2760001240102000006035072920000
Version ..........: 2.0
Manufacturer .....: unknown
Serial number ....: 03507292
Name of cardholder: Hanno Wagner
Language prefs ...: de
Sex ..............: male
URL of public key : https://blog.rince.de/4cf2d85a.txt
Login data .......: rince
Signature PIN ....: forced
Key attributes ...: 2048R 2048R 2048R
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3
Signature counter : 204
Signature key ....: 069B C697 0BCB B079 D166  C0C4 3512 C2E2 3F4C 33A6
      created ....: 2014-12-19 17:07:11
Encryption key....: FDB9 2670 3AF8 A7B8 3352  18EB 6033 BEFC 5A92 775A
      created ....: 2014-12-19 17:07:40
Authentication key: F132 92A0 5884 5290 59CF  65F6 AEB2 C8E8 8651 4EAA
      created ....: 2014-12-19 17:07:57
General key info..: pub  2048R/3F4C33A6 2014-12-19 Hanno 'Rince' Wagner 
sec#  3744R/4CF2D85A  created: 2014-12-19  expires: 2024-12-16
ssb>  2048R/3F4C33A6  created: 2014-12-19  expires: 2024-12-16
                      card-no: 0006 03507292
ssb>  2048R/5A92775A  created: 2014-12-19  expires: 2024-12-16
                      card-no: 0006 03507292
ssb>  2048R/86514EAA  created: 2014-12-19  expires: 2024-12-16
                      card-no: 0006 03507292

I have no problem signing files or Emails:

Code:

rince@russet ~ $ LANG=C gpg --default-key 0x4CF2D85A --armor --sign foo.txt 
rince@russet ~ $ more foo.txt
foo.txt      foo.txt.asc  

So, no errror message or something similar.
But when I try to sign another persons GPG-Key, I get the following:

Code:

rince@russet ~ $ LANG=C gpg --default-key 0x4CF2D85A --sign-key 0xBFC81ADE

pub  4096R/BFC81ADE  created: 2015-08-12  expires: 2020-08-10  usage: SCA 
                     trust: unknown       validity: unknown
sub  4096R/51B78023  created: 2015-08-12  expires: 2020-08-10  usage: E   
[..]
This key is due to expire on 2020-08-10.
Are you sure that you want to sign this key with your
key "Hanno 'Rince' Wagner " (4CF2D85A)

Really sign? (y/N) y
gpg: secret key parts are not available
gpg: signing failed: general error

Key not changed so no update needed.

I can not see why Yubikey won't help signing the key, is this expected behaviour?

Statistics: Posted by Rince — Mon Aug 24, 2015 8:31 am

Yubico Forum

Re: [Bug] OpenPGP-Applet, PGP-keys won't sign other keys

[Bug] OpenPGP-Applet, PGP-keys won't sign other keys