I'm trying to figure out what I can and can't do with my Librem Key as far as using the key slots. I've generated an RSA 4096-bit key with signing, encryption, and authentication subkeys, backed it up to a CD, and then transferred the keys to the Librem Key using
I then removed the Librem Key, deleted the public and private keys for my generated key, and plugged the Librem Key back in. Now, I'm able to encrypt files using the public key stored on the card:
[test@localhost ~]$ gpg -r firstname.lastname@example.org --encrypt test_unencr gpg: key [snipped-hex-string-1]: public key "email@example.com <firstname.lastname@example.org>" imported gpg: Total number processed: 1 gpg: imported: 1 gpg: checking the trustdb gpg: no ultimately trusted keys found gpg: [snipped-hex-string-2]: There is no assurance this key belongs to the named user sub rsa4096/[snipped-hex-string-2] 2020-10-28 email@example.com <firstname.lastname@example.org> Primary key fingerprint: [snipped-hex-string-3] Subkey fingerprint: [snipped-hex-string-4] It is NOT certain that the key belongs to the person named in the user ID. If you *really* know what you are doing, you may answer the next question with yes. Use this key anyway? (y/N) y [test@localhost ~]$ ls | grep test_unencr test_unencr test_unencr.gpg
But if I try to decrypt the file, I get an error:
[test@localhost ~]$ gpg --decrypt -r email@example.com test_unencr.gpg gpg: encrypted with rsa4096 key, ID [snipped-hex-string-1], created 2020-10-28 "firstname.lastname@example.org <email@example.com>" gpg: public key decryption failed: No secret key gpg: decryption failed: No secret key
I thought part of the point of these smartcards was that they allowed you to take your private key with you and use it while preventing malicious software from reading your private key. Is there a way to use a GPG smartcard to decrypt files, or is this not possible?