Maniphest T8339

Kleopatra: Add option to generate a new key on card using a sk_keyID.gpg backup file to restore the encrypt key
Open, NormalPublic
Actions

Assigned To
None
Authored By
• ebo
Jul 9 2026, 2:38 PM
Tags
Subscribers
• alexk
• ebo
• ikloecker
• werner

Description

We have a backup format for secret (sub)keys sk_keyID.gpg which is generated when you create a key on a smart card and choose to make a backup of the encryption key.

Now we want to add a card action in Kleopatras smart card window (could maybe be named "Generate Keys using Backup"). It should only be executed on an empty smart card and in the end there should be as many subkeys as are generated by the "Generate New Keys" action (3).

It is not clear yet how Kleopatra should accomplish the action and if a new gpg command needs to be implemented.

These are the steps you have to do currently on the command line for restoring the encryption key backup to a new smart card (in GPD 5.0.2):

gpg/card> generate --algo=brainpoolP256r1 OPENPGP.1 # create signing key
gpg --full-gen-key  # create public key for the signing key
    (14) Existing key from card
gpg --edit-key NAME # given in last step
gpg> bkuptocard /path/sk-backupdatei.gpg # copy encrypt key to card
   (2) Encryption key
gpg> addkey  # add encryption key zu public key
    (14) Existing key from card
   (2) F431A26E54E99AC04E8BEABED9701A955B93E382 OPENPGP.2 brainpoolP256r1 (encr*)
save

Or, if you have generated keys for all key slots in the first step (like "Generate New Keys" in Kleopatra does or gpg --card-edit generate):

gpg --edit-key NAME
key 2  # select encryption key
delkey # delete the encrypt key, because otherwise the pubkey has a no longer existing key listed after the next step
bkuptocard … # copy encrypt key to card
  (2) Encryption key
addkey # add encryption key zu public key
  (14) Existing key from card
   (2) F431A26E54E99AC04E8BEABED9701A955B93E382 OPENPGP.2 brainpoolP256r1 (encr*)
save

Details

Version
gpd 5.0.2 and vsd 3.3.7

Related Objects
Search...

Event Timeline

• ebo triaged this task as Normal priority.Jul 9 2026, 2:38 PM
• ebo created this task.
• ebo mentioned this in T6934: Kleopatra: Add card action to restore gpgsk backup file to a new card.Jul 9 2026, 2:41 PM
• ebo added a comment.Jul 9 2026, 3:39 PM

Werner said to put this on hold till he fixes the bkuptocard command to work in this case, too. It was originally designed for adding the subkey to the original secret key, there was no need to update the pubkey then. But in the usecase here we have a different secret key, as the original one was lost.

• werner changed the status of subtask T8344: gpg: Fix edit-key bkuptocard from Open to Testing.Jul 15 2026, 10:55 AM
• ikloecker added subscribers: • werner, • ikloecker.Jul 15 2026, 11:21 AM
In T8344#220548, @werner wrote:

Restoring an encryption subkey is now easy if you have an sk_KEYID.gpg backup:

  1. Get a fresh card or factory-reset a card.
  2. gpg --card-edit, then "admin", then "generate primary"
  3. gpg --edit-key NEWKEYID, use "bkuptocard sk_KEYID.gpg"
  4. Optionally use gpg --edit-key to add a new authentication (ssh) key to the card.
• ebo added a comment.EditedMon, Oct 12, 4:02 PM

For me it did not work as described above. I tried this with Gpg4win-5.1.1 (gpg 2.5.24) and a Yubikey.
I took the following steps with a fresh card, note that you need to know the algorithm to use for the primary key, if you want one which matches the algorithm of the subkey you want to restore.

  1. gpg --card-edit, then "admin"
  2. "key-attr" otherwise the primary key will be created with RSA2048, maybe dependent on the card used. (I set a new algo for all slots, probably only necessary for the first slot)
  3. "generate primary" -> a key with only the primary key with features certify and sign is created with the given user ID. Quit.
  4. "gpg --edit-key NEWKEYID"

probably optional: copy the sk_KEYID.gpg to %APPDATA%\gnupg (as giving the full path in the next step is a bit tricky; but if you give the full path for the backup file correctly, it should work without this step),

  1. "bkuptocard sk_KEYID.gpg"

Intermediate result: a primary with a public key in the first slot and the restored encryption subkey in the 2. slot but without a public key.

  1. addkey, (14) existing key from card, (2) encryption key […]
  2. save

Result:

pub   rsa3072 2026-10-12 [SC] [verfällt: 2027-10-12]
      9682267ECAE48DA7A95B809091D3351225844B6D
uid        [ ultimativ ] Recovery Test
sub   brainpoolP256r1 2026-06-08 [E] [verfällt: 2027-06-08]
      1BB19320163509988BB56B9F8C5F296A9A4B4AF5

I would not really call this easy, maybe I did it wrong?

• ebo added a comment.Mon, Oct 12, 4:49 PM

To make it better readable in comparison with my original description:

gpg --card-edit
gpg/card>key-attr # set key slot attributes 
  (1 or 2)
  (key strength)
gpg/card>generate primary # create cert/sign key with public key
gpg --edit-key NAME # given in last step
gpg> bkuptocard /path/sk-backupdatei.gpg # copy encrypt key to card
   (2) Encryption key
gpg> addkey  # add encryption key zu public key
   (14) Existing key from card
   (2) F431A26E54E99AC04E8BEABED9701A955B93E382 OPENPGP.2 brainpoolP256r1 (encr*)
save
• ebo renamed this task from Draft: Kleopatra: Add option to generate a new key on card using a sk_keyID.gpg backup file to restore the encrypt key to Kleopatra: Add option to generate a new key on card using a sk_keyID.gpg backup file to restore the encrypt key.Wed, Oct 14, 9:26 AM
• ebo added a project: vsd40.Wed, Oct 14, 9:50 AM