Arch Linux

Raketenjoint

Member

Registered: 2018-04-13

Posts: 3

Yubikey GPG: no secret key

Ĥi everyone,

I bought a Yubikey 5 NFC and moved my existing gpg key onto it according to the official manual Using Your YubiKey with OpenPGP and also read the YubiKey-Guide.
After encrypting some test file with my public key:

$ gpg -vvv --recipient "firstname surname" --encrypt wallpaper.jpg 
gpg: using character set 'utf-8'
gpg: using pgp trust model
gpg: key 8AF0EDCD894E7BB7: accepted as trusted key
gpg: using subkey 6AB6777BBCC7A394 instead of primary key 8AF0EDCD894E7BB7
gpg: This key belongs to us
gpg: reading from 'wallpaper.jpg'
gpg: writing to 'wallpaper.jpg.gpg'
gpg: RSA/AES encrypted for: "6AB6777BBCC7A394 firstname surname <firstname.surname@mailbox.org>"

I cannot decrypt it anymore with my encryption subkey:

$ gpg --decrypt -vvv wallpaper.jpg.gpg 
gpg: using character set 'utf-8'
# off=0 ctb=85 tag=1 hlen=3 plen=524
:pubkey enc packet: version 3, algo 1, keyid 6AB6777BBCC7A394
        data: [4096 bits]
gpg: public key is 6AB6777BBCC7A394
gpg: using subkey 6AB6777BBCC7A394 instead of primary key 8AF0EDCD894E7BB7
gpg: pinentry launched (118634 qt 1.1.0 /dev/pts/3 xterm-termite :0)
# off=527 ctb=d2 tag=18 hlen=2 plen=0 partial new-ctb
:encrypted data packet:
        length: unknown
        mdc_method: 2
gpg: using subkey 6AB6777BBCC7A394 instead of primary key 8AF0EDCD894E7BB7
gpg: encrypted with 4096-bit RSA key, ID 6AB6777BBCC7A394, created 2017-02-23
      "firstname surname <firstname.surname@mailbox.org>"
gpg: public key decryption failed: Card error
gpg: decryption failed: No secret key

The same error occurs under Windows with Kleopratra.
My Android smartphone can decrypt mail messages with OpenKeyChain so my Yubikey should be configured correctly?
Here is an overview over my smartcard which matches the tutorial results:

$ gpg --card-status
Reader ...........: Yubico YubiKey OTP FIDO CCID 00 00
Application ID ...: D2760001240102010006090713820000
Application type .: OpenPGP
Version ..........: 2.1
Manufacturer .....: Yubico
Serial number ....: 09071382
Name of cardholder: surname firstname
Language prefs ...: en
Salutation .......: Mr.
URL of public key : https://pgp.key-server.io/0x8AF0EDCD894E7BB7
Login data .......: firstname.surname@mailbox.org
Signature PIN ....: not forced
Key attributes ...: rsa4096 rsa4096 rsa4096
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 0 3
Signature counter : 1
Signature key ....: 42B3 9364 B2EC FB58 B6C8  4DE7 3717 83F4 35CD F628
      created ....: 2020-01-31 23:20:45
Encryption key....: 1714 6CC3 F924 F4BE D04A  1176 6AB6 777B BCC7 A394
      created ....: 2017-02-23 17:02:06
Authentication key: 4D34 405A C53B 5159 B661  3F84 3CC7 4D38 6814 7F2B
      created ....: 2020-01-16 20:59:35
General key info..: sub  rsa4096/371783F435CDF628 2020-01-31 firstname surname <firstname.surname@mailbox.org>
sec#  rsa4096/8AF0EDCD894E7BB7  created: 2017-02-23  expires: 2022-02-22
ssb>  rsa4096/6AB6777BBCC7A394  created: 2017-02-23  expires: 2022-02-22
                                card-no: 0006 09071382
ssb>  rsa4096/3CC74D3868147F2B  created: 2020-01-16  expires: never     
                                card-no: 0006 09071382
ssb>  rsa4096/371783F435CDF628  created: 2020-01-31  expires: 2022-01-30
                                card-no: 0006 09071382

I already tried different pinentry programs: pinentry-wayland, pinentry-tty, pinentry-qt, pinentry-gtk-2. No difference.
I tried on Wayland and X Server Arch Linux installations.
I already killed the gpg-agent.
I already contacted Yubico Support who asked me to reach for Arch Linux Community.

Does anybody has an idea why gpg-agent cannot retrieve my encryption subkey from my Yubikey 5 NFC?
Could my subkeys cause issues?
Thank you in advance for your help! Please tell how I can provide further details for debugging.

SubS0

Member

Registered: 2015-02-10

Posts: 41

Re: Yubikey GPG: no secret key

Not sure that it will be helpfull as I don’t see anything wrong in the informations you provide at first glance, but I’m not an expert. The strange thing is that it seems that you are well prompted for your password, so the interface between key and system may not be the problem…

Are you sure CCID mode is enabled on your key ? 

 ykman info

I suppose that you have checked, but does the pcscd.service is active ?

https://github.com/drduh/YubiKey-Guide is a very complete ressource (but may need some adjustments)  to verify the procedure.

I would do it a second time (this guide worked well for me) and try the GPG mailing list if it fails.

Last edited by SubS0 (2020-03-04 22:37:47)