Unable to delete private subkeys in GnuPG if no master key present
I have a GnuPG key pair with a master key (only Certify capability) and 3 subkeys (Sign, Encrypt and Authenticate capabilities respectively). Actually, when I start, I only have the private keys of the subkeys (I have a stub, marked with #, instead of the master private key)
I do as follows:
- I list private keys (
gpg --list-secret-keys). There is a master key stub (#) an three subkeys. - I encrypt a message with public Encrypt subkey (
gpg -e USER) - I decrypt the message (
gpg -d): Ok. - I delete de the three subkeys (
gpg --edit-key).gpg --delete-secret-keysdoes not work on master key (it's only a stub) nor on the subkeys. - I delete the public master key (
gpg --delete-keys) - I try to decrypt message from step 2: Not able, no private keys, Ok. I list private keys with
gpg --list-secret-keys: No keys - I kill gpg-agent (
killall gpg-agent) - I import public keys from key server again (
gpg --receive-keys) - I try to decrypt message from step 2 and surprisingly I am able to decrypt it by introducing the passphrase that protects the private subkeys! The private keys are there if I execute
gpg --list-secret-keysagain.
I guess I didn't delete correctly the private subkeys, I guess with the gpg --edit-key command I only deleted the public subkeys. Buy how can I delete the private subkeys if no master key is present (it's only a stub)?
After importing the secret master key again, I'm able to delete the master private key and his three subkeys by executing gpg --delete-secret-key. Is this the only option I have? Isn't it possible to delete secret subkeys if the master key is only a stub?
linux command-line gnupg pgp
asked Dec 28 '18 at 12:18
Manuel SchmidtManuel Schmidt
11114
add a comment |
I have a GnuPG key pair with a master key (only Certify capability) and 3 subkeys (Sign, Encrypt and Authenticate capabilities respectively). Actually, when I start, I only have the private keys of the subkeys (I have a stub, marked with #, instead of the master private key)
I do as follows:
- I list private keys (
gpg --list-secret-keys). There is a master key stub (#) an three subkeys. - I encrypt a message with public Encrypt subkey (
gpg -e USER) - I decrypt the message (
gpg -d): Ok. - I delete de the three subkeys (
gpg --edit-key).gpg --delete-secret-keysdoes not work on master key (it's only a stub) nor on the subkeys. - I delete the public master key (
gpg --delete-keys) - I try to decrypt message from step 2: Not able, no private keys, Ok. I list private keys with
gpg --list-secret-keys: No keys - I kill gpg-agent (
killall gpg-agent) - I import public keys from key server again (
gpg --receive-keys) - I try to decrypt message from step 2 and surprisingly I am able to decrypt it by introducing the passphrase that protects the private subkeys! The private keys are there if I execute
gpg --list-secret-keysagain.
I guess I didn't delete correctly the private subkeys, I guess with the gpg --edit-key command I only deleted the public subkeys. Buy how can I delete the private subkeys if no master key is present (it's only a stub)?
After importing the secret master key again, I'm able to delete the master private key and his three subkeys by executing gpg --delete-secret-key. Is this the only option I have? Isn't it possible to delete secret subkeys if the master key is only a stub?
linux command-line gnupg pgp
asked Dec 28 '18 at 12:18
Manuel SchmidtManuel Schmidt
11114
add a comment |
I have a GnuPG key pair with a master key (only Certify capability) and 3 subkeys (Sign, Encrypt and Authenticate capabilities respectively). Actually, when I start, I only have the private keys of the subkeys (I have a stub, marked with #, instead of the master private key)
I do as follows:
- I list private keys (
gpg --list-secret-keys). There is a master key stub (#) an three subkeys. - I encrypt a message with public Encrypt subkey (
gpg -e USER) - I decrypt the message (
gpg -d): Ok. - I delete de the three subkeys (
gpg --edit-key).gpg --delete-secret-keysdoes not work on master key (it's only a stub) nor on the subkeys. - I delete the public master key (
gpg --delete-keys) - I try to decrypt message from step 2: Not able, no private keys, Ok. I list private keys with
gpg --list-secret-keys: No keys - I kill gpg-agent (
killall gpg-agent) - I import public keys from key server again (
gpg --receive-keys) - I try to decrypt message from step 2 and surprisingly I am able to decrypt it by introducing the passphrase that protects the private subkeys! The private keys are there if I execute
gpg --list-secret-keysagain.
I guess I didn't delete correctly the private subkeys, I guess with the gpg --edit-key command I only deleted the public subkeys. Buy how can I delete the private subkeys if no master key is present (it's only a stub)?
After importing the secret master key again, I'm able to delete the master private key and his three subkeys by executing gpg --delete-secret-key. Is this the only option I have? Isn't it possible to delete secret subkeys if the master key is only a stub?
linux command-line gnupg pgp
asked Dec 28 '18 at 12:18
Manuel SchmidtManuel Schmidt
11114
I have a GnuPG key pair with a master key (only Certify capability) and 3 subkeys (Sign, Encrypt and Authenticate capabilities respectively). Actually, when I start, I only have the private keys of the subkeys (I have a stub, marked with #, instead of the master private key)
I do as follows:
- I list private keys (
gpg --list-secret-keys). There is a master key stub (#) an three subkeys. - I encrypt a message with public Encrypt subkey (
gpg -e USER) - I decrypt the message (
gpg -d): Ok. - I delete de the three subkeys (
gpg --edit-key).gpg --delete-secret-keysdoes not work on master key (it's only a stub) nor on the subkeys. - I delete the public master key (
gpg --delete-keys) - I try to decrypt message from step 2: Not able, no private keys, Ok. I list private keys with
gpg --list-secret-keys: No keys - I kill gpg-agent (
killall gpg-agent) - I import public keys from key server again (
gpg --receive-keys) - I try to decrypt message from step 2 and surprisingly I am able to decrypt it by introducing the passphrase that protects the private subkeys! The private keys are there if I execute
gpg --list-secret-keysagain.
I guess I didn't delete correctly the private subkeys, I guess with the gpg --edit-key command I only deleted the public subkeys. Buy how can I delete the private subkeys if no master key is present (it's only a stub)?
After importing the secret master key again, I'm able to delete the master private key and his three subkeys by executing gpg --delete-secret-key. Is this the only option I have? Isn't it possible to delete secret subkeys if the master key is only a stub?
linux command-line gnupg pgp
linux command-line gnupg pgp
asked Dec 28 '18 at 12:18
Manuel SchmidtManuel Schmidt
11114
asked Dec 28 '18 at 12:18
Manuel SchmidtManuel Schmidt
11114
edited Dec 28 '18 at 13:04
Manuel Schmidt
asked Dec 28 '18 at 12:18
Manuel SchmidtManuel Schmidt
11114
asked Dec 28 '18 at 12:18
Manuel SchmidtManuel Schmidt
11114
asked Dec 28 '18 at 12:18
Manuel SchmidtManuel Schmidt
11114
11114
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
For GnuPG 2.1+, secret keys are stored in gpg-agent and only referenced by the main keyring.
Re-import the public subkeys again, then run gpg --list-secret-keys --with-keygrip. This will show the 'fingerprint' of the raw asymmetric key belonging to each subkey (do not confuse this with the fingerprint of the whole PGP subkey with metadata and all).
For each subkey that you want to delete, run:
gpg-connect-agent "delete_key <keygrip>" /bye
answered Jan 8 at 8:54
grawitygrawity
235k37498553
Had the same problem. It worked.
– Toni Homedes i Saun
Jan 20 at 8:59
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1388426%2funable-to-delete-private-subkeys-in-gnupg-if-no-master-key-present%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
For GnuPG 2.1+, secret keys are stored in gpg-agent and only referenced by the main keyring.
Re-import the public subkeys again, then run gpg --list-secret-keys --with-keygrip. This will show the 'fingerprint' of the raw asymmetric key belonging to each subkey (do not confuse this with the fingerprint of the whole PGP subkey with metadata and all).
For each subkey that you want to delete, run:
gpg-connect-agent "delete_key <keygrip>" /bye
answered Jan 8 at 8:54
grawitygrawity
235k37498553
Had the same problem. It worked.
– Toni Homedes i Saun
Jan 20 at 8:59
add a comment |
For GnuPG 2.1+, secret keys are stored in gpg-agent and only referenced by the main keyring.
Re-import the public subkeys again, then run gpg --list-secret-keys --with-keygrip. This will show the 'fingerprint' of the raw asymmetric key belonging to each subkey (do not confuse this with the fingerprint of the whole PGP subkey with metadata and all).
For each subkey that you want to delete, run:
gpg-connect-agent "delete_key <keygrip>" /bye
answered Jan 8 at 8:54
grawitygrawity
235k37498553
Had the same problem. It worked.
– Toni Homedes i Saun
Jan 20 at 8:59
add a comment |
For GnuPG 2.1+, secret keys are stored in gpg-agent and only referenced by the main keyring.
Re-import the public subkeys again, then run gpg --list-secret-keys --with-keygrip. This will show the 'fingerprint' of the raw asymmetric key belonging to each subkey (do not confuse this with the fingerprint of the whole PGP subkey with metadata and all).
For each subkey that you want to delete, run:
gpg-connect-agent "delete_key <keygrip>" /bye
answered Jan 8 at 8:54
grawitygrawity
235k37498553
For GnuPG 2.1+, secret keys are stored in gpg-agent and only referenced by the main keyring.
Re-import the public subkeys again, then run gpg --list-secret-keys --with-keygrip. This will show the 'fingerprint' of the raw asymmetric key belonging to each subkey (do not confuse this with the fingerprint of the whole PGP subkey with metadata and all).
For each subkey that you want to delete, run:
gpg-connect-agent "delete_key <keygrip>" /bye
answered Jan 8 at 8:54
grawitygrawity
235k37498553
answered Jan 8 at 8:54
grawitygrawity
235k37498553
answered Jan 8 at 8:54
grawitygrawity
235k37498553
answered Jan 8 at 8:54
grawitygrawity
235k37498553
235k37498553
Had the same problem. It worked.
– Toni Homedes i Saun
Jan 20 at 8:59
add a comment |
Had the same problem. It worked.
– Toni Homedes i Saun
Jan 20 at 8:59
Had the same problem. It worked.
– Toni Homedes i Saun
Jan 20 at 8:59
Had the same problem. It worked.
– Toni Homedes i Saun
Jan 20 at 8:59
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1388426%2funable-to-delete-private-subkeys-in-gnupg-if-no-master-key-present%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
