3

I have imported a private key into gpg and I can see the key is there:

$ gpg --list-keys
/home/stuyod/.gnupg/pubring.kbx
---------------------------------
pub   rsa2048 2021-03-25 [C]
      AA582DA4180115CF069355075E0F30EAA7985DA1
uid           [ unknown] My Signing Key

$ gpg --list-secret-keys
/home/stuyod/.gnupg/pubring.kbx
---------------------------------
sec   rsa2048 2021-03-25 [C]
      AA582DA4180115CF069355075E0F30EAA7985DA1
uid           [ unknown] My Signing Key

But, when I try to sign with it, I get an error that suggests there is no secret key:

$ gpg --default-key "AA582DA4180115CF069355075E0F30EAA7985DA1" --detach-sign bar.txt
gpg: Warning: not using 'AA582DA4180115CF069355075E0F30EAA7985DA1' as default key: No secret key
gpg: all values passed to '--default-key' ignored
gpg: no default secret key: Unusable secret key
gpg: signing failed: Unusable secret key

But, since I can see the key with --list-secret-keys it doesn't make sense.

1 Answer 1

3

The usage field of that key only contains C (Certification).

Without a subkey, this key can only be used to sign other keys, as it does not have the S (Sign), E (Encrypt) or A (Authenticate) usages allowed, and therefore the key is rejected when trying to use it as a signing key.

2
  • Thanks! I figured that out as well. This was an imported key and I needed to use the following environment variable to set the "S" flag: cat signing.key | PEM2OPENPGP_USAGE_FLAGS=certify,sign pem2openpgp "My Signing Key " > signing.gpgkey
    – b08248
    Mar 25, 2021 at 22:06
  • @b08248, the same test should be applied on the recipient side, so if they have a copy with the bit clear, the signature should be rejected. Mar 25, 2021 at 22:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .