Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have an OpenPGP smart card loaded with a gpg key object. I get a read out of my gpg key when I type the command "gpg --card-status". However, I have no idea how to actually use the keys on the smart card. When I type "gpg --list-keys" for example, nothing from the smart card shows up. I am running these commands on Ubuntu 12.04. Is there some special argument or command required to actually use the keys on the smart card?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

It is recommended to use Subkeys with your card. The Free Software Foundation Europe not only issues OpenPGP smartcards (the membership card), but also provides great tutorials on how to use them.

The most important command to use with gpg is (copied from the man pages):

   --card-edit
          Present a menu to work with a smartcard. The subcommand "help" provides an
          overview on available commands. For a detailed description, please see the
          Card HOWTO  at  http://www.gnupg.org/documentation/howtos.html#GnuPG-card-
          HOWTO .

Creating a Primary Key Set

What you have to do to create a set of primary keys on your card (ommit the comments in gpg):

gpg --card-edit
command> admin        # Enter admin screen
command> generate     # Create primary keys on your card

While generating the keys, gpg will ask you if you want to save a copy of the keys to your computer. Do so to have a backup in case your card gets lost or broken, copying to some USB stick or some other offline device which stays disconnected afterwards is recommended.

Using the keys on your card works totally the same like using "normal" keys on your hard drive.

Using Subkeys

FSFE offers a lengthy tutorial on how to use subkeys with your smartcard which they recommend. You will create subkeys on your computer and transfer them to the smartcard afterwards. Key step is using keytocard to transfer your private subkeys to the smartcard. For more details I refer to the tutorial as this includes mostly non-smartcard related stuff.

share|improve this answer
    
Do you know why they recommend to use subkeys? –  brunoqc Apr 17 '13 at 17:30
    
Using subkeys is generally recommended. Have a highly secure primary key (store offline, maybe larger key size, only use for creating/signing other keys, no or long-term expiry date set) and one (or more) "everyday life" keys on your computer or even phones (where they're exposed to more risks) which you can invalidate easily without loosing all your connections to the web of trust. Read Debian's recommendations on subkeys and what I wrote on the numbers of keys to have on security.se. –  Jens Erat Apr 17 '13 at 18:58
    
How do you allow other computers to read the same smartcard key? It does not seem to be just plug-in-play. After doing a gpg --export-secret-keys and reimporting the keys on a separate computer, I get this error: gpg: public key decryption failed: Operation cancelled gpg: decryption failed: No secret key. –  Master Blaster Awesome Man Apr 18 '13 at 1:04
    
----edit--- I have to export the secret keys (which don't have the private keys), and import them on whatever machine I plan on using. Also, on the new machine, I had to restart the gpg-agent to get the private key to work. Thanks for the help! –  Master Blaster Awesome Man Apr 18 '13 at 1:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.