I have an OpenPGP smart card key (YubiKey NEO) as well as a local secret key installed in my GnuPG keyring.

I'd like to encrypt and sign a file with my card's key, not the key in my keyring. How can I specify what key I'd like to sign with?

If my filesystem secret key id is DEADBEEF and my smartcard key is DEADBEE5, how do I sign with that key?


The signing key is selected with -u / --local-user:

gpg --local-user 0xDEADBEE5 --sign file

This option can be given several times in order to combine signatures of several keys:

gpg --local-user 0xDEADBEE5 --local-user 0x12345678 --sign file
  • According to the man page using --local-user is the same as using --default-user as in my answer
    – Anthon
    Dec 6 '14 at 9:00
  • 1
    @Anthon It leads to the same result. That doesn't mean that --default-* should be recommended for this usage. I have been on the GnuPG mailinglist for years. I have never seen something like that before. Dec 6 '14 at 9:06
  • Well yeah, it looks like the issue came up once on gnupg-users and that you where the one who provided the answer with your reading of the man page ;-). For me specifying an option with -key in its name feels much more appropriate when I want to use a specific key than specifying something with -user YMMV.
    – Anthon
    Dec 6 '14 at 9:19
  • 5
    I think @Anthon meant --default-key in his comment above. Running with that, one difference between --local-user and --default-key in my experience, is that the first fails if a matching key isn't present, while the second will fall back to other keys. For that reason, I'd be very wary of putting --default-key in scripts. Jun 19 '18 at 20:37
  • 1
    I tested and confirmed @JackO'Connor's comment with gpg 2.2.4. The man for --default-key says If there is no secret key available for any of the specified values, GnuPG will not emit an error message but continue as if this option wasn't given.
    – wisbucky
    Dec 3 '19 at 0:22

You should specify --default-key:

gpg -s --default-key DEADBEE5 input > output

and check afterwards with

gpg -d < output | head -1

From the gpg man page( --sign section):

The key to be used for signing is chosen by default or can be set with the --local-user and --default-key options.

  • gpg: conflicting commands when I try to encrypt and sign. Dec 5 '14 at 19:31
  • @NaftuliTzviKay Sorry --sign-key is for signing other keys with a specific key. I updated the answer (and tested beforehand this time).
    – Anthon
    Dec 5 '14 at 19:35
  • --default-* makes little sense on the command line. These options are for the config file. Dec 6 '14 at 8:52
  • 3
    The difference between --local-user and --default-key is that --local-user will give an error if you specify a non-existent key. With --default-key, it will ignore a non-existent key and use the first key in the keyring.
    – wisbucky
    Dec 3 '19 at 0:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.