With
enable-extended-key-format
in gpg-agent.conf and using
gpg --passwd FINGERPRINT_OF_SUBKEY
to remove the passphrase from that subkey the key gets garbled and using it produces a "checksum error". In the concreted case the primary key was a stub key
GnuPG 2.1 from today's master
Odd, I cannot reproduce this:
$ gpg --quick-generate-key foobar@example.org ... $ gpg --list-keys --with-keygrip --with-subkey-fingerprint foobar gpg: WARNING: unsafe permissions on homedir '/home/teythoon/repos/g10/local/gnupghome' pub rsa2048 2017-06-12 [SC] [expires: 2019-06-12] D87BBB2139C9585D27ABF2F8E7481C924FD8D6C4 Keygrip = 31B0BEA2AD387FD95CA37402588D67A05FD965D7 uid [ultimate] foobar@example.org sub rsa2048 2017-06-12 [E] F61CBFFF4B90364A2EBE5DF87CCF3CAC4882EFB0 Keygrip = C6FFF73E1C4EB187B33ED9251B175C332A9152EB $ head -n1 '/home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/31B0BEA2AD387FD95CA37402588D67A05FD965D7.key' '/home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/C6FFF73E1C4EB187B33ED9251B175C332A9152EB.key' ==> /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/31B0BEA2AD387FD95CA37402588D67A05FD965D7.key <== Key: (protected-private-key (rsa (n #00AE363B6E465819F97FB5576D964DD3BB ==> /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/C6FFF73E1C4EB187B33ED9251B175C332A9152EB.key <== Key: (protected-private-key (rsa (n #00DE1822964A4B208BDD19B52D1C298EB1 $ gpg --passwd F61CBFFF4B90364A2EBE5DF87CCF3CAC4882EFB0 [changing password...] $ gpg --decrypt huhu.foobar.gpg gpg: WARNING: unsafe permissions on homedir '/home/teythoon/repos/g10/local/gnupghome' [entering new password...] gpg: encrypted with 2048-bit RSA key, ID 7CCF3CAC4882EFB0, created 2017-06-12 "foobar@example.org" huhu
Do you think that this can be related to the stub key? Can you please check again that this is actually a problem? FTR, if I enter the wrong (e.g. the old passphrase, I also get a checksum error.
I will try to reproduce it. It might be that --passwd also trigerred the conversion to the new format.
Still, looks totally fine to me:
$ gpg --quick-generate-key frob@example.org $ gpg --list-keys --with-keygrip --with-subkey-fingerprint frob pub rsa2048 2017-06-13 [SC] [expires: 2019-06-13] E2C6C77E3CD5F7F14778685BA45E481F9096DCD6 Keygrip = 3903C2725C604FDF46122D729A6ECA4E18E8D853 uid [ultimate] frob@example.org sub rsa2048 2017-06-13 [E] 6E782BB2FB79D631F1D98CEC9250CFC9C90D643D Keygrip = 346B8AE956D2D1D542CCE09010ECEA911068234B $ head -n1 /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/3903C2725C604FDF46122D729A6ECA4E18E8D853.key /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/346B8AE956D2D1D542CCE09010ECEA911068234B.key ==> /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/3903C2725C604FDF46122D729A6ECA4E18E8D853.key <== (21:protected-private-key(3:rsa(1:n257:brei ==> /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/346B8AE956D2D1D542CCE09010ECEA911068234B.key <== (21:protected-private-key(3:rsa(1:n257:more brei $ echo huhu | gpg --encrypt --recipient frob --armor > huhu.frob.gpg $ gpgconf --kill all [... enabling the new format...] $ gpgconf --launch gpg-agent $ gpg --passwd 6E782BB2FB79D631F1D98CEC9250CFC9C90D643D ... $ gpgconf --kill all && gpgconf --launch gpg-agent $ gpg --decrypt huhu.frob.gpg gpg: encrypted with 2048-bit RSA key, ID 9250CFC9C90D643D, created 2017-06-13 "frob@example.org" huhu $ head -n1 /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/3903C2725C604FDF46122D729A6ECA4E18E8D853.key /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/346B8AE956D2D1D542CCE09010ECEA911068234B.key ==> /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/3903C2725C604FDF46122D729A6ECA4E18E8D853.key <== Key: (protected-private-key (rsa (n #00A83C780BA9079ECBB73359323B27442A ==> /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/346B8AE956D2D1D542CCE09010ECEA911068234B.key <== Key: (protected-private-key (rsa (n #00BA5D4C2FD92B2961CD1F760952622EBB
FWIW, I ran a make check today and got several failed tests when using the extended key format. Checking out master to see whether this was caused by another patch I am working on, showed that it worked on master. Checking out my local branch again, then passed the test.
Sorry, I went through considerable length to reproduce this, but failed.
This is the scenario you reported, with the primary key on card:
$ gpg --list-secret-keys --with-keygrip --with-subkey-fingerprint card sec> rsa2048 2017-07-17 [C] [expires: 2018-07-17] 86458F93B206C7CD9399425472126BCC0551A143 Keygrip = 491D653F037931A01DBB61ACF850BC62F5F1B939 Card serial no. = 0006 04250529 uid [ultimate] cert on card <cert-on-card@example.org> ssb rsa2048 2017-07-17 [S] [expires: 2018-07-17] 24A28950AFFAD69BD56DED314FC7E7D3DB70BEA6 Keygrip = 21FFBF4639C2BE772F7ADAC85971220ECDDE3464 $ head -n1 $GNUPGHOME/private-keys-v1.d/{491D653F037931A01DBB61ACF850BC62F5F1B939,21FFBF4639C2BE772F7ADAC85971220ECDDE3464}.key ==> /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/491D653F037931A01DBB61ACF850BC62F5F1B939.key <== (20:shadowed-private-key(3:rsa(1:n257:brei ==> /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/21FFBF4639C2BE772F7ADAC85971220ECDDE3464.key <== (21:protected-private-key(3:rsa(1:n257:brei $ gpg --local-user cert --sign --armor <<< huhu > huhu.cert-on-key.gpg gpg: using subkey 4FC7E7D3DB70BEA6 instead of primary key 72126BCC0551A143 gpg: writing to stdout gpg: RSA/SHA256 signature from: "4FC7E7D3DB70BEA6 cert on card <cert-on-card@example.org>" $ gpg --verify huhu.cert-on-key.gpg gpg: original file name='' gpg: Signature made Mon 17 Jul 2017 12:38:32 PM CEST gpg: using RSA key 24A28950AFFAD69BD56DED314FC7E7D3DB70BEA6 gpg: issuer "cert-on-card@example.org" gpg: using subkey 4FC7E7D3DB70BEA6 instead of primary key 72126BCC0551A143 gpg: Good signature from "cert on card <cert-on-card@example.org>" [ultimate] gpg: binary signature, digest algorithm SHA256, key algorithm rsa2048 $ gpgconf --kill all $ gpg --passwd 24A28950AFFAD69BD56DED314FC7E7D3DB70BEA6 gpg (GnuPG) 2.1.22-beta94; Copyright (C) 2017 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. gpg: no running gpg-agent - starting '/home/teythoon/repos/g10/local/bin/gpg-agent' gpg: waiting for the agent to come up ... (5s) gpg: connection to agent established gpg: key 72126BCC0551A143/72126BCC0551A143: error changing passphrase: Not implemented $ echo $? 0 $ gpgconf --kill all && gpgconf --launch gpg-agent $ gpg --local-user cert --sign --armor <<< huhu > huhu2.cert-on-key.gpg gpg: using subkey 4FC7E7D3DB70BEA6 instead of primary key 72126BCC0551A143 gpg: writing to stdout gpg: RSA/SHA256 signature from: "4FC7E7D3DB70BEA6 cert on card <cert-on-card@example.org>" $ gpg --verify huhu2.cert-on-key.gpg gpg: original file name='' gpg: Signature made Mon 17 Jul 2017 12:44:43 PM CEST gpg: using RSA key 24A28950AFFAD69BD56DED314FC7E7D3DB70BEA6 gpg: issuer "cert-on-card@example.org" gpg: using subkey 4FC7E7D3DB70BEA6 instead of primary key 72126BCC0551A143 gpg: Good signature from "cert on card <cert-on-card@example.org>" [ultimate] gpg: binary signature, digest algorithm SHA256, key algorithm rsa2048 $ head -n1 $GNUPGHOME/private-keys-v1.d/{491D653F037931A01DBB61ACF850BC62F5F1B939,21FFBF4639C2BE772F7ADAC85971220ECDDE3464}.key ==> /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/491D653F037931A01DBB61ACF850BC62F5F1B939.key <== (20:shadowed-private-key(3:rsa(1:n257:brei ==> /home/teythoon/repos/g10/local/gnupghome/private-keys-v1.d/21FFBF4639C2BE772F7ADAC85971220ECDDE3464.key <== Key: (protected-private-key (rsa (n #00C724298A2E6EC76F8A8F1B83BE142706
(Note how it also tried to change the passphrase of the primary key, but this failed with 'not implemented').