Page MenuHome GnuPG
Create Task
Maniphest T6859

S/MIME keys are not deleted
Open, LowPublic
Actions

Description

I noticed this while testing with Kleopatra, but it is true for the command line, too.
In Kleopatra it looks like this before deletion:

Then "delete" the key via right click -> delete and it is removed from the certificate view, but not from the private-keys-v1.d folder:

This is not version related, gpgsm does not have an option to delete secret keys (yet).
But as SMIME keys usually live on smart cards, the need to delete a secret key locally should be seldom needed.
But I would expect a warning in Kleopatra, that the keyfile has to be deleted manually, too.

Related Objects

Event Timeline

• ebo created this task.Nov 30 2023, 2:53 PM
aheinecke triaged this task as Normal priority.Dec 11 2023, 1:12 PM
aheinecke added projects: S/MIME, Restricted Project.
aheinecke added a subscriber: aheinecke.

I know I discussed this with werner several times and never really understood it because it makes for an inconsistent user interface / user experience. You delete an OpenPGP Secret key and then the keyfile is gone, you delete an S/MIME secret key and then the keyfile still exists. But it has been so forever T960
Maybe kleopatra should for the very rare cases where a key is used by multiple certificates do a search for the keygrip and warn if this also deletes the secret portion of another secret key? But that would then be also true for OpenPGP.

aheinecke lowered the priority of this task from Normal to Low.Dec 11 2023, 1:15 PM

Actually prio is rather low or even Wontfix. Since it has been this way forever and no one really complained. I think deleting secret keys esp. for S/MIME where you can't just create a testing key but need to have it signed by a CA is not really there.

• werner added a subscriber: • werner.Dec 11 2023, 5:04 PM

Searching by keygrip is actually fast with keyboxd.

FWIW, gpg-card searches for keys this way. However, there is still the issue that the key might be used by ssh - in this case you need to look at ~/.gnupg/sshcontrol of the use-for-ssh flag in the *key file.

• ebo added a comment.Dec 11 2023, 5:12 PM

As it is so complicated to check all possibilities:

How about just an info window informing the user that the certificate was only deleted in the Kleopatra view. And that it is still on their computer at XXX and if it is not needed for another purpose, they should consider deleting it manually.

aheinecke added a comment.Dec 12 2023, 7:12 AM

Checking if the key is not otherwise used is unrelated and should be a diifferent Task since this also relates to OpenPGP. For me this Task is about creating a similar API for gpgsm (--delete-secret-key) that we have for OpenPGP.