Yubico Forum

In the following use case, what's the best solution to the broken step 7?

1. Insert Yubikey on machine M1 that has OpenGPG
2. rm -rf .gnupg
3. gpg --card-edit, admin, generate
>. AFAIK this installs a "stub" private key in the OpenGPG keychain, which I can now see.
4. Encrypt something with the new public key and send to machine M1
5. Eject Yubikey
6. Insert Yubikey into a totall different machine M2
7. Attempt to decrypt
> Arrg! The OpenGPG Keychain on M2 doesn't have the "stub" private key, I can't do anything!

I do know ways to get that stub into the keychain, but they are really sucky:
- Add a step 3.1: from the GPG keychain, export the secret key. Since it's just a stub, send it to M2, and import into the keychain on M2.
> Sucky because of having to mess with an extra file.
- Or, Add a step 3.1: upload the public key to a server. Then on machine M2, do: followed by
> Sucky because what if machine M2 is offline/airgapped, then this won't work.

What I want is to be able to walk up to any machine that has OpenGPG installed, insert my Yubikey, access some ciphertext either online or from a USB, and decrypt.

I don't want to have to mess with some file or key server (Steps 3.1 above) or arcane commands too. I just want to insert the Yubikey and start decrypting.

Is there a way?

TMIA, /rb

good question. i got the same problem now and the only ways to get it work seems to upload your public key to a keyserver or import the public or private key to your air-gapped M2.

not that nice that i thought it could be.
i'm wondering that the public key can not be generated from the smartcard.