| Yubico Forum https://forum.yubico.com/ |
|
| [Bug] OpenPGP-Applet, PGP-keys won't sign other keys https://forum.yubico.com/viewtopic.php?f=26&t=2010 |
Page 1 of 1 |
| Author: | Rince [ Mon Aug 24, 2015 8:31 am ] |
| Post subject: | [Bug] OpenPGP-Applet, PGP-keys won't sign other keys |
Hi, I use the Yubikey Neo primarily for signing and encrypting files. But when I tried to sign another users GPG-key, gpg fails: This is my GPG-Agent-Version: Code: rince@russet ~ $ LANG=C gpg-agent --version gpg-agent (GnuPG) 2.0.22 libgcrypt 1.5.3 This is my Yubikey NEO: Code: rince@russet ~ $ LANG=C gpg --card-status Application ID ...: D2760001240102000006035072920000 Version ..........: 2.0 Manufacturer .....: unknown Serial number ....: 03507292 Name of cardholder: Hanno Wagner Language prefs ...: de Sex ..............: male URL of public key : https://blog.rince.de/4cf2d85a.txt Login data .......: rince Signature PIN ....: forced Key attributes ...: 2048R 2048R 2048R Max. PIN lengths .: 127 127 127 PIN retry counter : 3 3 3 Signature counter : 204 Signature key ....: 069B C697 0BCB B079 D166 C0C4 3512 C2E2 3F4C 33A6 created ....: 2014-12-19 17:07:11 Encryption key....: FDB9 2670 3AF8 A7B8 3352 18EB 6033 BEFC 5A92 775A created ....: 2014-12-19 17:07:40 Authentication key: F132 92A0 5884 5290 59CF 65F6 AEB2 C8E8 8651 4EAA created ....: 2014-12-19 17:07:57 General key info..: pub 2048R/3F4C33A6 2014-12-19 Hanno 'Rince' Wagner <wagner@rince.de> sec# 3744R/4CF2D85A created: 2014-12-19 expires: 2024-12-16 ssb> 2048R/3F4C33A6 created: 2014-12-19 expires: 2024-12-16 card-no: 0006 03507292 ssb> 2048R/5A92775A created: 2014-12-19 expires: 2024-12-16 card-no: 0006 03507292 ssb> 2048R/86514EAA created: 2014-12-19 expires: 2024-12-16 card-no: 0006 03507292 I have no problem signing files or Emails: Code: rince@russet ~ $ LANG=C gpg --default-key 0x4CF2D85A --armor --sign foo.txt rince@russet ~ $ more foo.txt foo.txt foo.txt.asc So, no errror message or something similar. But when I try to sign another persons GPG-Key, I get the following: Code: rince@russet ~ $ LANG=C gpg --default-key 0x4CF2D85A --sign-key 0xBFC81ADE pub 4096R/BFC81ADE created: 2015-08-12 expires: 2020-08-10 usage: SCA trust: unknown validity: unknown sub 4096R/51B78023 created: 2015-08-12 expires: 2020-08-10 usage: E [..] This key is due to expire on 2020-08-10. Are you sure that you want to sign this key with your key "Hanno 'Rince' Wagner <wagner@rince.de>" (4CF2D85A) Really sign? (y/N) y gpg: secret key parts are not available gpg: signing failed: general error Key not changed so no update needed. I can not see why Yubikey won't help signing the key, is this expected behaviour? |
|
| Author: | DavidW [ Tue Sep 01, 2015 8:44 am ] |
| Post subject: | Re: [Bug] OpenPGP-Applet, PGP-keys won't sign other keys |
Key signing is carried out using the certifying key (the C flag in the type field), which is your main key, not the signing subkey. Your gpg --card-status shows 'sec#', indicating the main secret key is offline, so GnuPG is correctly reporting that the secret key needed for the key signing operation is unavailable. You might be able to force key signing using the signing subkey (don't forget to put a ! after the key ID in this case), but this is not standard practice as revocation of the signing subkey would invalidate the signature and it goes against the type flags in your key. |
|
| Page 1 of 1 | All times are UTC + 1 hour |
| Powered by phpBB® Forum Software © phpBB Group https://www.phpbb.com/ |
|