I've been following the directions here for creating a GPG key and storing the "master" key offline. Everything went exactly as the directions said. However, after the directions on how to remove the master key, I tested gpg --import public.gpg-key private.gpg-key to see if it would restore the master key to my keyring. But after doing that, gpg --list-secret-keys still showed sec# for the master key, indicating that the master key isn't there.

What am I doing wrong?

(In the meantime, since I'd backed up my $HOME/.gnupg before the step of removing the master key, I restored it, made sure it was good, added a copy of that .gnupg to the external media on which the master key exists (in addition to all the files created by following the directions), then re-deleted the master key. I figure that in an emergency I can temporarily replace the my .gnupg with the copy I'd saved.)

1 Answer 1


I tried the instructions and it works for me, using either GPG 1.4.16 or 2.1.11. Could you have possibly misspelled the commands in "Exporting the Final Product"? There are some unnecessary '\>'-s in there.

You can check the contents of private.gpg-key with gpg --list-packets <private.gpg-key. E.g., when I pipe that into egrep "(^:secret|protect IV)", I see:

:secret key packet:
    protect IV:  4e 1b 98 12 19 f6 fa 16 36 e3 4d 9d 9a 02 e6 52
:secret sub key packet:
    protect IV:  96 f8 68 65 c8 b8 f0 d6 59 59 73 e1 63 30 f5 21
:secret sub key packet:
    protect IV:  e1 43 e4 25 49 15 c5 ad 1e 09 75 cf c6 1f d0 4c
:secret sub key packet:
    protect IV:  af da 37 82 dc f0 f3 24 6e b7 9f 4f 77 70 84 25

This shows the file contains the master signing key and 3 subkeys. When the file is created with --export-secret-subkeys instead of --export-secret-keys, the first IV is empty.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .