My public pgp key has a sub key with a signature (self signed) that contains an invalid policy url. How can I update the signature and remove the policy?

Using gpg (GnuPG) 1.4.21 on macOS Sierra, 10.12.3 (16D32)


Not really a solution, but that's how I dealt with the issue (using GnuPG 2.2).

First, I had the same problem with my UIDs. That could be solved: Remove the policy url from the gpg.conf, then delete the signatures (gpg --edit-key and delsig) and self-sign the uids again with the primary key.

For sub keys this approach does not work. Each sub key has to be signed by the primary key once it is created, additional signatures don't make sense. So for GnuPG there is no need to support editing or adding sub key signatures. So I had to try something else (test case with a uid test).

  1. Export the complete key: gpg --export-secret-key test > testexport
  2. Split the key into packets: gpgsplit testexport
  3. Remove the packet that contains invalid signature. In my test case the sub key signature was contained in the last of the snippet files, named 000006-002.sig. You can double-check and examine the contents by gpg --list-packets 000006-002.sig.
  4. Create a signature for the snippet containing the secret sub key: gpg --local-user test --output 000006.newsig --detach-sign 000005-007.secret_subkey
  5. Put the snippets, including the new signature, back together: cat 0* > newkey
  6. Delete the (old) key from the keyring: gpg --delete-key test
  7. Import the new key back to the keyring: gpg --import newkey. But for the sub key the import unfortunately failed as the signature was not valid.

So this approach was too naive, and one should look deeper into OpenPGP signatures in order to create a valid one.

In the end, as meanwhile my key had been uploaded to a key server by someone else, I decided to revoke the sub key and created a new one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.