Page MenuHome GnuPG
Create Task
Maniphest T5412

Getting "Invalid digest algorithm", when trying to generate ECDH keys, in batch mode
Closed, ResolvedPublic
Actions

Description

Support for ECDH keys is a great and much needed improvement. However, while I can create such keys in interactive mode, I receive an Invalid digest algorithm error, if I try to generate keys in batch mode.

Here's the command I use:
gpg --batch --full-gen-key --expert --homedir /tmp/gpgtest gpgopts (gen-key is also getting the same error)

In gpgopts file, I have the following options:
%no-protection
Key-Type: ecdh
Key-Curve: ed25519
#Key-Type: ecdsa
#Key-Curve: nistp384
Subkey-Type: ecdh
Subkey-Curve: cv25519
Subkey-Usage: encrypt
Expire-Date: 0
Name-Comment: "my secrets"
Name-Real: "arctic"
Preferences: SHA512 SHA384 SHA256 SHA224 AES256 TWOFISH AES192 AES ZLIB BZIP2 ZIP Uncompressed
%commit

I tried various key types, and while ECDH curve 25519 is accepted for subkeys, the ECDSA nistp384 is the strongest key type that I could use, in batch mode.

Please let me know if any additional information is required.

Details

Version
2.3.1

Event Timeline

masoudbahar created this task.Apr 27 2021, 5:14 AM
• werner claimed this task.Apr 27 2021, 8:14 AM
• werner triaged this task as Normal priority.
• werner added projects: gnupg (gpg23), OpenPGP.
• werner edited projects, added gnupg, FAQ; removed gnupg (gpg23), Bug Report.Apr 27 2021, 8:33 AM

You can't use ecdh with ed25519.

In general I suggest to switch to --quick-gen-key. In your case this would be as easy as

gpg --quick-gen-key --batch --passphrase ""  "arctic (my secrets)" default default never

If you want to use non-standard preferences, use --default-preference-list (but please do not use Twofish, sha224, sha1 or aes192)

Instead of the first "default" you may also specify the actual algorithm. This is currently a bit limited but you can change what "default" means by using

--default-new-key-algo ed25519/sign+cv25519/encr

This is the current default, but you get the idea.

• werner closed this task as Resolved.Apr 27 2021, 8:34 AM
masoudbahar added a comment.Apr 27 2021, 12:13 PM

Thanks for the quick response Werner. I knew I could use it with quick-gen-key and I’ve updated my config file to have it as default.
But, just for my understanding, is there a reason ed25519 cannot be used with full-gen-key and gen-key in batch mode?

• werner added a comment.Apr 27 2021, 2:39 PM

The curve is not defined to be used for ECDH (encryption); in fact it should in general only be used with the EdDSA
algorithm. You need to use "Key-Type: eddsa". Note that the EdDSA signing algorithm is different than the commonly used ECDSA signing algorithm.

Well, it should throw a better error.