Can I decrypt files with a GPG smartcard?

Question

I'm trying to figure out what I can and can't do with my Librem Key as far as using the key slots. I've generated an RSA 4096-bit key with signing, encryption, and authentication subkeys, backed it up to a CD, and then transferred the keys to the Librem Key using keytocard.

I then removed the Librem Key, deleted the public and private keys for my generated key, and plugged the Librem Key back in. Now, I'm able to encrypt files using the public key stored on the card:

[test@localhost ~]$ gpg -r test@test.com --encrypt test_unencr
gpg: key [snipped-hex-string-1]: public key "test@test.com <test@test.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: checking the trustdb
gpg: no ultimately trusted keys found
gpg: [snipped-hex-string-2]: There is no assurance this key belongs to the named user

sub  rsa4096/[snipped-hex-string-2] 2020-10-28 test@test.com <test@test.com>
 Primary key fingerprint: [snipped-hex-string-3]
      Subkey fingerprint: [snipped-hex-string-4]

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N) y

[test@localhost ~]$ ls | grep test_unencr
test_unencr
test_unencr.gpg

But if I try to decrypt the file, I get an error:

[test@localhost ~]$ gpg --decrypt -r test@test.com test_unencr.gpg
gpg: encrypted with rsa4096 key, ID [snipped-hex-string-1], created 2020-10-28
      "test@test.com <test@test.com>"
gpg: public key decryption failed: No secret key
gpg: decryption failed: No secret key

I thought part of the point of these smartcards was that they allowed you to take your private key with you and use it while preventing malicious software from reading your private key. Is there a way to use a GPG smartcard to decrypt files, or is this not possible?

Answer 1

NOTE: This is over simplified but this is the basics please no one jump all over me we are trying to explain the basics of subkeys and master key pair. This is not meant to be definitive.

Yes it is possible but when the card it setup it must be setup correctly usually you will create on master gpg key pair that never expires then use that pair to generate subkeys again normally one for signing and one for encryption then you backup the master key and remove it from your laptop of whatever and then transfer the subkeys to the card that then can be used to encrypt and decrypt messages and files but if your laptop or card is lost or stolen you haven't lost your master keys and can allow the subkeys to expire and generate new ones with your backup master key pair.

EDIT: To do what you said in your message you need to remove the master key pair then import the subkeys. If you simple make the subkeys them remove the master it also removes the master subkeys so generate a master back it up then generate the subkeys back them up remove the master keys then import the subkeys.

EDIT: The correct process of steps would be

• Generate master key pair
• Backup master secret key
• Generate subkeys
• Backup secret subkeys
• Remove master secret keys
• Import subkeys
• Transfer keys to card or laptop ect.