I'm trying to figure out what I can and can't do with my Librem Key as far as using the key slots. I've generated an RSA 4096-bit key with signing, encryption, and authentication subkeys, backed it up to a CD, and then transferred the keys to the Librem Key using keytocard
.
I then removed the Librem Key, deleted the public and private keys for my generated key, and plugged the Librem Key back in. Now, I'm able to encrypt files using the public key stored on the card:
[test@localhost ~]$ gpg -r test@test.com --encrypt test_unencr
gpg: key [snipped-hex-string-1]: public key "test@test.com <test@test.com>" imported
gpg: Total number processed: 1
gpg: imported: 1
gpg: checking the trustdb
gpg: no ultimately trusted keys found
gpg: [snipped-hex-string-2]: There is no assurance this key belongs to the named user
sub rsa4096/[snipped-hex-string-2] 2020-10-28 test@test.com <test@test.com>
Primary key fingerprint: [snipped-hex-string-3]
Subkey fingerprint: [snipped-hex-string-4]
It is NOT certain that the key belongs to the person named
in the user ID. If you *really* know what you are doing,
you may answer the next question with yes.
Use this key anyway? (y/N) y
[test@localhost ~]$ ls | grep test_unencr
test_unencr
test_unencr.gpg
But if I try to decrypt the file, I get an error:
[test@localhost ~]$ gpg --decrypt -r test@test.com test_unencr.gpg
gpg: encrypted with rsa4096 key, ID [snipped-hex-string-1], created 2020-10-28
"test@test.com <test@test.com>"
gpg: public key decryption failed: No secret key
gpg: decryption failed: No secret key
I thought part of the point of these smartcards was that they allowed you to take your private key with you and use it while preventing malicious software from reading your private key. Is there a way to use a GPG smartcard to decrypt files, or is this not possible?