In the smart card window, the usage column for the auth key shows "sign, authenticate" although the subkey shows only "authenticate" in the certificate details:
ssb brainpoolP256r1/1B1EDB6E99D48643
erzeugt: 2026-06-30 verfällt: 2027-06-30 Nutzung: A
Kartennummer:0006 15493291I thought at first that maybe the slot capabilities are shown here instead of the key usage, but for an empty card only "authenticate" is shown:
| rLIBKLEO Libkleo | |||
| rLIBKLEO90fc0154f15f Add helpers to get usage flags of key or subkey | |||
| rLIBKLEObb76ca6205f1 Add helpers to get usage flags of key or subkey | |||
| rKLEOPATRA Kleopatra | |||
| rKLEOPATRA721cdd60c6ba Show usage of key for card slot (if there is a key) | |||
| rKLEOPATRA6e234b372907 Show common usage of card slot and key for card keys | |||
| rKLEOPATRA859c9446a86a Add getter for key usage flags to KeyPairInfo | |||
| rKLEOPATRA2e3df20c80a4 Show usage of key for card slot (if there is a key) | |||
| rKLEOPATRA096470b6c398 Show common usage of card slot and key for card keys | |||
| rKLEOPATRAeb1689d63849 Add getter for key usage flags to KeyPairInfo | |||
@ikloecker asked me to provide the keypairinfo from debugview:
3724 20857.415167 7888 kleopatra.exe org.kde.pim.kleopatra: KEYPAIRINFO : 1C49D83114A007D1D83CFE46FFC42C5BFB49707C OPENPGP.1 sc 1782824981 brainpoolP256r1 3725 20857.415254 7888 kleopatra.exe org.kde.pim.kleopatra: KEYPAIRINFO : 3A99A453AFCE1020774C46658B9E7017488C24CD OPENPGP.2 e 1782824981 brainpoolP256r1 3726 20857.415326 7888 kleopatra.exe org.kde.pim.kleopatra: KEYPAIRINFO : 2A0F7C05F34D2D3CE4BE10515AFA85A85E7B64C3 OPENPGP.3 sa 1782824981 brainpoolP256r1
This shows that the wrong info comes from scdaemon.
Scdaemon can only know the keyslot capabilties, the actual keys capablities can only be queried from gpg or gpgsm respectively.
Therefore we need to change the query in Kleopatra.
The idea to fix this is to use the common capabilities of card slot and key (if a key exists for the slot).
There's a problem for PIV.9E (aka the Card Authentication Key) because scdaemon reports a (authentication) as usage (which makes sense given the name of the key), but gpgsm (or X.509) doesn't support authentication as usage for S/MIME certificates so that one can only write signing certificates to this slot. The common capability is nothing.
Werner said to only show the pubkey info. Only if no pubkey is available show the slot info given by scdaemon.
I guess for PIV.9E there should be no usage shown if I read the gpg-card man page correctly: "Note that GnuPG does currently not use the the Card authentication key".
The usage column now shows the usage of the certificate if there is a certificate for the card slot. Otherwise, the "default" usage (as reported by scdaemon) is shown.