I have a GnuPG key pair with a master key (only Certify capability) and 3 subkeys (Sign, Encrypt and Authenticate capabilities respectively). Actually, when I start, I only have the private keys of the subkeys (I have a stub, marked with #
, instead of the master private key)
I do as follows:
- I list private keys (
gpg --list-secret-keys
). There is a master key stub (#
) an three subkeys. - I encrypt a message with public Encrypt subkey (
gpg -e USER
) - I decrypt the message (
gpg -d
): Ok. - I delete de the three subkeys (
gpg --edit-key
).gpg --delete-secret-keys
does not work on master key (it's only a stub) nor on the subkeys. - I delete the public master key (
gpg --delete-keys
) - I try to decrypt message from step 2: Not able, no private keys, Ok. I list private keys with
gpg --list-secret-keys
: No keys - I kill gpg-agent (
killall gpg-agent
) - I import public keys from key server again (
gpg --receive-keys
) - I try to decrypt message from step 2 and surprisingly I am able to decrypt it by introducing the passphrase that protects the private subkeys! The private keys are there if I execute
gpg --list-secret-keys
again.
I guess I didn't delete correctly the private subkeys, I guess with the gpg --edit-key
command I only deleted the public subkeys. Buy how can I delete the private subkeys if no master key is present (it's only a stub)?
After importing the secret master key again, I'm able to delete the master private key and his three subkeys by executing gpg --delete-secret-key
. Is this the only option I have? Isn't it possible to delete secret subkeys if the master key is only a stub?