Page MenuHome GnuPG

gnu-divert-to-card secret subkey bug
Open, NormalPublic

Description

I have a secret key with three additional subkeys. The three additional RSA keys
are stored on a YubiKey and no longer in my keyring. The main signing key and
the first encryption key are moved to a secure location and purged from the
keyring as well.

With GnuPG 2.0 the setup works as expected. gkg2 -K shows the main key as stub
(sec#), the subkeys as moved to card (ssb>) and the main encryption key isn't
listed at all.

Yesterday I installed GnuPG 2.1 in my home directory. gpg2 -K doesn't display
the subkeys as moved to card. Additionally it lists the old encryption key as
stub. --export-secret-subkeys no longer exports the subkeys as
gnu-divert-to-card stubs which breaks OpenKeyChain
(http://www.openkeychain.org/faq/ How to prepare a YubiKey NEO for
OpenKeychain?). OpenKeyChain falls back to NFC communication to a YubiKey NEO
when a key is marked as gnu-divert-to-card in its keychain. Additionally there
is an error message during the import: "error receiving key from agent: Unusable
secret key".

This output should help you to understand the bug even better:

$ /usr/bin/gpg2 --version
gpg (GnuPG) 2.0.25
libgcrypt 1.6.3

$ /usr/bin/gpg2 -K

/home/heimes/.gnupg/pubring.gpg

sec# rsa4096/0xC788C4C1D4550D45 2011-12-30 [expires: 2018-12-28]
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
ssb> 2048R/0x86685249212DB689 2015-03-26
ssb> 2048R/0x8947F1E0F47B5E1B 2015-03-26
ssb> 2048R/0xD962168DF72F58FC 2015-03-26

$ /usr/bin/gpg2 --armor --export-secret-subkeys --export-options export-minimal
C788C4C1D4550D45 | gpg2 --list-packets | grep -A6 "secret sub key packet"
:secret sub key packet:

version 4, algo 1, created 1427389239, expires 0
pkey[0]: [2048 bits]
pkey[1]: [17 bits]
gnu-divert-to-card S2K, algo: 3, SHA1 protection, hash: 2
serial-number:  d2 76 00 01 24 01 02 00 00 06 03 02 59 02 00 00
keyid: 86685249212DB689

:secret sub key packet:

version 4, algo 1, created 1427389315, expires 0
pkey[0]: [2048 bits]
pkey[1]: [17 bits]
gnu-divert-to-card S2K, algo: 3, SHA1 protection, hash: 2
serial-number:  d2 76 00 01 24 01 02 00 00 06 03 02 59 02 00 00
keyid: 8947F1E0F47B5E1B

:secret sub key packet:

        version 4, algo 1, created 1427389334, expires 0
        pkey[0]: [2048 bits]
        pkey[1]: [17 bits]
        gnu-divert-to-card S2K, algo: 3, SHA1 protection, hash: 2
        serial-number:  d2 76 00 01 24 01 02 00 00 06 03 02 59 02 00 00
        keyid: D962168DF72F58FC

$ gpg2 --version
gpg (GnuPG) 2.1.2
libgcrypt 1.6.3

$ gpg2 -K

/home/heimes/.gnupg/pubring.gpg

sec# rsa4096/0xC788C4C1D4550D45 2011-12-30 [expires: 2018-12-28]
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
ssb rsa2048/0x86685249212DB689 2015-03-26 [expires: 2016-03-25]
ssb rsa2048/0x8947F1E0F47B5E1B 2015-03-26 [expires: 2016-03-25]
ssb rsa2048/0xD962168DF72F58FC 2015-03-26 [expires: 2016-03-25]
ssb# rsa4096/0x59C8FAE9A25222C6 2011-12-30 [expires: 2016-12-28]

$ gpg2 --armor --export-secret-subkeys --export-options export-minimal
C788C4C1D4550D45 | gpg2 --list-packets | grep -A6 "secret sub key packet"
gpg: key 0xC788C4C1D4550D45/0x86685249212DB689: error receiving key from agent:
Unusable secret key - skipped
gpg: key 0xC788C4C1D4550D45/0x8947F1E0F47B5E1B: error receiving key from agent:
Unusable secret key - skipped
gpg: key 0xC788C4C1D4550D45/0xD962168DF72F58FC: error receiving key from agent:
Unusable secret key - skipped
:secret sub key packet:

version 4, algo 1, created 1325272759, expires 0
pkey[0]: [4096 bits]
pkey[1]: [17 bits]
gnu-dummy S2K, algo: 0, simple checksum, hash: 0
protect IV: 
keyid: 59C8FAE9A25222C6

Details

Version
2.1

Event Timeline

heimes added projects: gnupg, Bug Report.
heimes added a subscriber: heimes.

Confirmed. I think that this is a regression.
EXPORT_KEY command of gpg-agent should return the stub secret key.