I'm trying to figure out what I can and can't do with my Librem Key as far as using the key slots. I've generated an RSA 4096-bit key with signing, encryption, and authentication subkeys, backed it up to a CD, and then transferred the keys to the Librem Key using keytocard.

I then removed the Librem Key, deleted the public and private keys for my generated key, and plugged the Librem Key back in. Now, I'm able to encrypt files using the public key stored on the card:

[test@localhost ~]$ gpg -r [email protected] --encrypt test_unencr
gpg: key [snipped-hex-string-1]: public key "[email protected] <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: checking the trustdb
gpg: no ultimately trusted keys found
gpg: [snipped-hex-string-2]: There is no assurance this key belongs to the named user

sub  rsa4096/[snipped-hex-string-2] 2020-10-28 [email protected] <[email protected]>
 Primary key fingerprint: [snipped-hex-string-3]
      Subkey fingerprint: [snipped-hex-string-4]

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N) y

[test@localhost ~]$ ls | grep test_unencr

But if I try to decrypt the file, I get an error:

[test@localhost ~]$ gpg --decrypt -r [email protected] test_unencr.gpg
gpg: encrypted with rsa4096 key, ID [snipped-hex-string-1], created 2020-10-28
      "[email protected] <[email protected]>"
gpg: public key decryption failed: No secret key
gpg: decryption failed: No secret key

I thought part of the point of these smartcards was that they allowed you to take your private key with you and use it while preventing malicious software from reading your private key. Is there a way to use a GPG smartcard to decrypt files, or is this not possible?

  • I added more explanation I hope this make sense if not please just ask. Feb 28, 2021 at 1:40

1 Answer 1


NOTE: This is over simplified but this is the basics please no one jump all over me we are trying to explain the basics of subkeys and master key pair. This is not meant to be definitive.

Yes it is possible but when the card it setup it must be setup correctly usually you will create on master gpg key pair that never expires then use that pair to generate subkeys again normally one for signing and one for encryption then you backup the master key and remove it from your laptop of whatever and then transfer the subkeys to the card that then can be used to encrypt and decrypt messages and files but if your laptop or card is lost or stolen you haven't lost your master keys and can allow the subkeys to expire and generate new ones with your backup master key pair.

EDIT: To do what you said in your message you need to remove the master key pair then import the subkeys. If you simple make the subkeys them remove the master it also removes the master subkeys so generate a master back it up then generate the subkeys back them up remove the master keys then import the subkeys.

EDIT: The correct process of steps would be

  • Generate master key pair
  • Backup master secret key
  • Generate subkeys
  • Backup secret subkeys
  • Remove master secret keys
  • Import subkeys
  • Transfer keys to card or laptop ect.
  • I have a backup, but this process seems like it would just get me to the starting point where I already was when attempting to encrypt/decrypt files using the smartcard. How would I actually perform the decryption?
    – zaen
    Feb 28, 2021 at 1:48
  • I think where you went wrong was when you removed the master keys you have to import the subkeys after you remove the master secret keys otherwise you have no way to decrypt. If everything is done correctly with your card oor yubikey whatever installed you can just gpg -d and it will work. Feb 28, 2021 at 3:00
  • You have to have the secret key to decrypt but when you remove the master secret it also remove your secret subkey so you have to then import the backed up subkeys i know it sounds stupid but it is the only way I will try to find the article that explains. Feb 28, 2021 at 3:03
  • youtu.be/xGsixSh6sC4 This is about yubikey but its very similar to smartcards Feb 28, 2021 at 3:11
  • I think I figured out what's going on, for some reason GPG wasn't fully deleting the old key and would re-import the old key (as evidenced by the 2020-10-28 date) instead of using the key on the card. I restored my correct public key from my backup and was then able to encrypt and decrypt using the Librem Key. I got the password prompt to unlock my Librem Key, which seems to match the process shown in the video.
    – zaen
    Feb 28, 2021 at 6:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .