1

I'm using Arch Linux Linux uplink 4.14.56-1-lts #1 SMP Tue Jul 17 20:11:42 CEST 2018 x86_64 GNU/Linux. I'm trying to solve a problem I'm currently have with GnuPG 2.2.9 (libgcrypt 1.8.3), but I've noticed I have these errors showing up all the time, for any operation I perform with gpg:

gpg: bad data signature from key 8975BA8B6100C6B1: Wrong key usage (0x19, 0x2)
gpg: bad data signature from key DEA16371974031A5: Wrong key usage (0x19, 0x2)

...so I'm not sure if that could be interfering with my other problem: signing Git commits and getting gpg failed to sign the data failed to write commit object.

This is the list of public/private keys that I have:

[gorre@uplink ~]$ gpg --list-keys
gpg: bad data signature from key 8975BA8B6100C6B1: Wrong key usage (0x19, 0x2)
gpg: bad data signature from key DEA16371974031A5: Wrong key usage (0x19, 0x2)
/home/gorre/.gnupg/pubring.kbx
------------------------------
pub   rsa4096 2015-07-21 [SC] [expires: 2019-07-21]
      94AE36675C464D64BAFA68DD7434390BDBE9B9C5
uid           [ unknown] Colin Ihrig ...
sub   rsa4096 2015-07-21 [E] [expires: 2019-07-21]

pub   rsa4096 2014-04-01 [SCEA] [expires: 2024-03-29]
      FD3A5288F042B6850C66B31F09FE44734EB7990E
uid           [ unknown] Jeremiah Senkpiel ...
uid           [ unknown] keybase.io/fishrock ...
sub   rsa4096 2014-04-01 [SEA] [expires: 2024-03-29]

pub   rsa4096 2014-11-10 [SCEA]
      71DCFD284A79C3B38668286BC97EC7A07EDE3FC1
uid           [ unknown] keybase.io/jasnell ...
uid           [ unknown] James M Snell ...
uid           [ unknown] James M Snell ...
sub   rsa2048 2014-11-10 [S] [expires: 2022-11-08]
sub   rsa2048 2014-11-10 [E] [expires: 2022-11-08]

pub   rsa2048 2013-11-18 [SC]
      DD8F2338BAE7501E3DD5AC78C273792F7D83545D
uid           [ unknown] Rod Vagg ...
uid           [ unknown] Rod Vagg ...
sub   rsa2048 2013-11-18 [E]

pub   rsa4096 2016-01-12 [SC]
      C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8
uid           [ unknown] Myles Borins ...
uid           [ unknown] Myles Borins ...
uid           [ unknown] Myles Borins ...
uid           [ unknown] Myles Borins (Not used after January 2017) ...
sub   rsa2048 2016-01-12 [E] [expires: 2024-01-10]
sub   rsa2048 2016-01-12 [SA] [expires: 2024-01-10]

pub   rsa4096 2015-12-17 [SC] [expires: 2019-12-17]
      B9AE9905FFD7803F25714661B63B535A4C206CA9
uid           [ unknown] Evan Lucas ...
uid           [ unknown] Evan Lucas ...
sub   rsa4096 2015-12-17 [E] [expires: 2019-12-17]

pub   rsa4096 2016-04-07 [SC]
      8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600
uid           [ unknown] Michaël Zasso (Targos) ...
sub   rsa4096 2016-04-07 [E]

pub   rsa4096 2016-10-07 [SC]
      77984A986EBC2AA786BC0F66B01FBB92821C587A
uid           [ unknown] Gibson Fahnestock ...
sub   rsa4096 2016-10-07 [E]

pub   rsa4096 2018-06-12 [SC]
      B1BEB985FA77CDF913E2EAE88E0DCA371CC3F4EC
uid           [ultimate] Gorre ...
sub   rsa4096 2018-06-12 [E]

[gorre@uplink ~]$ gpg --list-secret-keys
/home/gorre/.gnupg/pubring.kbx
------------------------------
sec   rsa4096 2018-06-12 [SC]
      MY_SECRET_KEY
uid           [ultimate] Gorre ...
ssb   rsa4096 2018-06-12 [E]

UPDATE

Looks like my initial issue was somehow with the gpg-agent; I ended up configuring $HOME/.gnupg/gpg-agent.conf as:

[gorre@uplink ~]$ nano ~/.gnupg/gpg-agent.conf
max-cache-ttl 86400
default-cache-ttl 86400

default-cache-ttl-ssh 86400
max-cache-ttl-ssh 86400

# Run pacman -Ql pinentry | grep /usr/bin/ for more options, I'm using Gnome 2.x
pinentry-program /usr/bin/pinentry-gnome3

[gorre@uplink ~]$ gpg-connect-agent reloadagent /bye

...and everything works fine now – for what I wanted. Still, those errors are there, every time I execute the gpg command, but it looks like it doesn't impact the functionality of gpg – to the extent of what I do with it.

|improve this question
  • When you create a subkey you can specify if it is for signature or encryption or both. The error message is probably because you are using a key created for encryption in git, which needs only to sign commit messages. – Patrick Mevzek Jul 29 '18 at 0:01
  • 1
    Somehow, I think that's either related with gpg version 2.9 or something in Arch Linux...or both. I see exactly the same error messages on some builds for Antergos. – x80486 Jul 29 '18 at 0:09
  • 1
    Your output does not show the key ID seen in the git output. Try adding --with-subkey-fingerprint – Patrick Mevzek Jul 29 '18 at 17:45
  • Have you by any chance used GPG to verify Node.js binaries? I get these messages for exactly the same keys (GitHub issue). – fagerbua Oct 31 '18 at 7:54
4

I solved this by editing my key and adding the "Signing" usage to the subkey which was encrypt-only.

First edit the key:

> gpg --edit-key "<my@email>"
gpg (GnuPG) 2.2.10; Copyright (C) 2018 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

gpg: bad data signature from key ZZZZZZZZZZZZZZZZ: Wrong key usage (0x19, 0x2)
Secret key is available.

sec  rsa4096/XXXXXXXXXXXXXXXX
     created: YYYY-MM-DD  expires: never       usage: SCEA
     trust: ultimate      validity: ultimate
ssb  rsa2048/YYYYYYYYYYYYYYYY
     created: YYYY-MM-DD  expires: YYYY-MM-DD  usage: S
ssb  rsa2048/ZZZZZZZZZZZZZZZZ
     created: YYYY-MM-DD  expires: YYYY-MM-DD  usage: E
[ultimate] (1). My Name <my@email>

The subkey that gpg was complaining about bad signing from was ZZZZZZZZZZZZZZZZ, the second key, and indeed, that one was encrypt-only (usage: E), so I added Signing to that one:

gpg> key 2

sec  rsa4096/XXXXXXXXXXXXXXXX
     created: YYYY-MM-DD  expires: never       usage: SCEA
     trust: ultimate      validity: ultimate
ssb  rsa2048/YYYYYYYYYYYYYYYY
     created: YYYY-MM-DD  expires: YYYY-MM-DD  usage: S
ssb* rsa2048/ZZZZZZZZZZZZZZZZ
     created: YYYY-MM-DD  expires: YYYY-MM-DD  usage: E
[ultimate] (1). My Name <my@email>

gpg> change-usage
Changing usage of a subkey.

Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Encrypt

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? s

Possible actions for a RSA key: Sign Encrypt Authenticate
Current allowed actions: Sign Encrypt

   (S) Toggle the sign capability
   (E) Toggle the encrypt capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? q

sec  rsa4096/XXXXXXXXXXXXXXXX
     created: YYYY-MM-DD  expires: never       usage: SCEA
     trust: ultimate      validity: ultimate
ssb  rsa2048/YYYYYYYYYYYYYYYY
     created: YYYY-MM-DD  expires: YYYY-MM-DD  usage: S
ssb* rsa2048/ZZZZZZZZZZZZZZZZ
     created: YYYY-MM-DD  expires: YYYY-MM-DD  usage: SE
[ultimate] (1). My Name <my@email>

Lastly, save the changes:

gpg> save

FWIW I used keybase a few years ago to generate this keypair, and I'm no gpg expert, so I don't know if this is the "proper" way to solve the issue, but it worked for me. Also, in the interests of full disclosure, there were actually two subkeys which were encrypt-only and I added Signing to both of them, but I edited the transcript above to make it clearer. YMMV.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.