I have a secret key with three additional subkeys. The three additional RSA keys
are stored on a YubiKey and no longer in my keyring. The main signing key and
the first encryption key are moved to a secure location and purged from the
keyring as well.
With GnuPG 2.0 the setup works as expected. gkg2 -K shows the main key as stub
(sec#), the subkeys as moved to card (ssb>) and the main encryption key isn't
listed at all.
Yesterday I installed GnuPG 2.1 in my home directory. gpg2 -K doesn't display
the subkeys as moved to card. Additionally it lists the old encryption key as
stub. --export-secret-subkeys no longer exports the subkeys as
gnu-divert-to-card stubs which breaks OpenKeyChain
(http://www.openkeychain.org/faq/ How to prepare a YubiKey NEO for
OpenKeychain?). OpenKeyChain falls back to NFC communication to a YubiKey NEO
when a key is marked as gnu-divert-to-card in its keychain. Additionally there
is an error message during the import: "error receiving key from agent: Unusable
secret key".
This output should help you to understand the bug even better:
$ /usr/bin/gpg2 --version
gpg (GnuPG) 2.0.25
libgcrypt 1.6.3
$ /usr/bin/gpg2 -K
/home/heimes/.gnupg/pubring.gpg
sec# rsa4096/0xC788C4C1D4550D45 2011-12-30 [expires: 2018-12-28]
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
ssb> 2048R/0x86685249212DB689 2015-03-26
ssb> 2048R/0x8947F1E0F47B5E1B 2015-03-26
ssb> 2048R/0xD962168DF72F58FC 2015-03-26
$ /usr/bin/gpg2 --armor --export-secret-subkeys --export-options export-minimal
C788C4C1D4550D45 | gpg2 --list-packets | grep -A6 "secret sub key packet"
:secret sub key packet:
version 4, algo 1, created 1427389239, expires 0 pkey[0]: [2048 bits] pkey[1]: [17 bits] gnu-divert-to-card S2K, algo: 3, SHA1 protection, hash: 2 serial-number: d2 76 00 01 24 01 02 00 00 06 03 02 59 02 00 00 keyid: 86685249212DB689
:secret sub key packet:
version 4, algo 1, created 1427389315, expires 0 pkey[0]: [2048 bits] pkey[1]: [17 bits] gnu-divert-to-card S2K, algo: 3, SHA1 protection, hash: 2 serial-number: d2 76 00 01 24 01 02 00 00 06 03 02 59 02 00 00 keyid: 8947F1E0F47B5E1B
:secret sub key packet:
version 4, algo 1, created 1427389334, expires 0 pkey[0]: [2048 bits] pkey[1]: [17 bits] gnu-divert-to-card S2K, algo: 3, SHA1 protection, hash: 2 serial-number: d2 76 00 01 24 01 02 00 00 06 03 02 59 02 00 00 keyid: D962168DF72F58FC
$ gpg2 --version
gpg (GnuPG) 2.1.2
libgcrypt 1.6.3
$ gpg2 -K
/home/heimes/.gnupg/pubring.gpg
sec# rsa4096/0xC788C4C1D4550D45 2011-12-30 [expires: 2018-12-28]
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
uid [ultimate] Christian Heimes XXX
ssb rsa2048/0x86685249212DB689 2015-03-26 [expires: 2016-03-25]
ssb rsa2048/0x8947F1E0F47B5E1B 2015-03-26 [expires: 2016-03-25]
ssb rsa2048/0xD962168DF72F58FC 2015-03-26 [expires: 2016-03-25]
ssb# rsa4096/0x59C8FAE9A25222C6 2011-12-30 [expires: 2016-12-28]
$ gpg2 --armor --export-secret-subkeys --export-options export-minimal
C788C4C1D4550D45 | gpg2 --list-packets | grep -A6 "secret sub key packet"
gpg: key 0xC788C4C1D4550D45/0x86685249212DB689: error receiving key from agent:
Unusable secret key - skipped
gpg: key 0xC788C4C1D4550D45/0x8947F1E0F47B5E1B: error receiving key from agent:
Unusable secret key - skipped
gpg: key 0xC788C4C1D4550D45/0xD962168DF72F58FC: error receiving key from agent:
Unusable secret key - skipped
:secret sub key packet:
version 4, algo 1, created 1325272759, expires 0 pkey[0]: [4096 bits] pkey[1]: [17 bits] gnu-dummy S2K, algo: 0, simple checksum, hash: 0 protect IV: keyid: 59C8FAE9A25222C6