336

I'm trying to copy my gpg key from one machine to another.

I do:

gpg --export ${ID} > public.key
gpg --export-secret-key ${ID} > private.key

Move files to new machine, and then:

gpg --import public.key
gpg: nyckel [ID]: public key [Name, e-mail] was imported
gpg: Total number of treated keys: 1
gpg:                 imported: 1  (RSA: 1)

gpg --allow-secret-key-import private.key
sec  [?]/[ID] [Creation date] [Name, e-mail]
ssb  [?]/[SUB-ID] [Creation date]

All looks good to me, but then:

$ gpg -d [file].gpg
gpg: encrypted with 4096-bit RSA-key, id [SUB-ID], created [Creation date]
  [Name, e-mail]
gpg: decryption failed: secret key not accessible

So the error message says that the file has been encrypted with [SUB-ID], which the secret key import appears to say it has imported. (The [SUB-ID] in both messages is the same).

So I'm clearly doing something wrong, but I don't know what.

Improve this question
1
  • 2
    You don't need to export the public key. The private key already includes the public key.
    – robertspierre
    Commented Jul 16, 2023 at 20:33

3 Answers 3

Reset to default
338

You need to add --import to the command line to import the private key. (You don't need to use the --allow-secret-key-import flag. According to the man page: "This is an obsolete option and is not used anywhere.")

gpg --import private.key
Improve this answer
7
  • 1
    Any chance you'd also know why gpg2 -e -r [ID] says "There is no assurance this key belongs to the named user"? I wish I had included it in the original question, but I noticed it only later.
    – user50849
    Commented Feb 16, 2015 at 7:54
  • 1
    GnuPG maintains a trust database which it uses to decide how much to trust what keys. For example, trust your own keys the most, keys that aren't directly or indirectly signed by any trusted keys the least. After you've just imported to an empty database, probably no keys at all are trusted. This trust database is separate from the database or keys themselves, so importing keys does not make them trusted unless they are signed by some already-trusted key. You have to stell GnuPG which keys you want to trust separately.
    – Celada
    Commented Feb 16, 2015 at 9:19
  • 5
    @Celeda, thanks, with --edit-key and and the trust command I managed to get the key trusted. Since my original question was how to copy the key from one machine to another, I think it would be appropriate to add something about that to your answer. I'd prefer not to edit your answer myself, and you seem to know a lot more than me about this.
    – user50849
    Commented Feb 16, 2015 at 10:05
  • I don't feel that I understand the trustdb well enough to talk about it in my answer. I'm glad you were able to work it out using the vague hints I gave in my comment.
    – Celada
    Commented Feb 16, 2015 at 11:53
  • Ok, I've re-titled the original question so it more specifically fits with the answer. That way I can ask a separate question the trustdb. Thanks for the help. :)
    – user50849
    Commented Feb 16, 2015 at 16:07
187

Above is only a partial answer. Complete answer is:

gpg --import private.key

  • Given the KEYID (e.g FA0339620046E260) from the output:

      gpg --edit-key {KEY} trust quit
  # enter 5<RETURN> (I trust ultimately)
  # enter y<RETURN> (Really set this key to ultimate trust - Yes)

  • OR use the automated command below:

      expect -c 'spawn gpg --edit-key {KEY} trust quit; send "5\ry\r"; expect eof'

Finally, verify that key is now trusted with [ultimate] instead of [unknown]

gpg --list-keys
Improve this answer
3
  • What do these extra commands do?
    – steinybot
    Commented Aug 26, 2018 at 7:24
  • 4
    @Steiny It makes the key trusted with [ultimate] instead of [unknown]. gpgtools.tenderapp.com/kb/faq/…
    – cmcginty
    Commented Oct 24, 2018 at 19:22
  • They chain the commands to what you are prompted. You can leave trust and quit off the command and just enter them when prompted. Note entering the 5 and y are responses to trust so entered before quit.
    – flurdy
    Commented Jun 14, 2023 at 15:02
18

I was importing from a backup that had an old version of gpg. Since the old computer wasn't available, only the backup, I couldn't export it first. This is what worked for me.

gpg --import old_home_dir/.gnupg/pubring.gpg
gpg --import old_home_dir/.gnupg/secring.gpg

If you want to be able to import secret keys without entering the passphrase immediately, use the --batch option.

To verify the public keys:

gpg --list-keys

To verify the secret keys:

gpg --list-secret-keys
Improve this answer
1
  • --batch is what I needed to import the key, in my case.
    – New Alexandria
    Commented Apr 3, 2022 at 21:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .