3

As you see, I have a key with id 12345689, and I'm trying to sign with it in git

gpg -k
/home/lz/.gnupg/pubring.kbx
---------------------------
pub   rsa4096 2020-03-02 [C]
      12345689
uid           [ unknown] Person Person <me@person.com>
sub   rsa4096 2020-03-02 [S] [expires: 2024-03-01]
sub   rsa4096 2020-03-02 [E] [expires: 2024-03-01]
sub   rsa4096 2020-03-02 [A] [expires: 2024-03-01]

But git considers this key ID unusable:

gpg2 --status-fd=2 -bsau 12345689 1
[GNUPG:] KEY_CONSIDERED 12345689 1
gpg: skipped "12345689": Unusable secret key
[GNUPG:] INV_SGNR 9 12345689
[GNUPG:] FAILURE sign 54
gpg: signing failed: Unusable secret key

as I researched, it's because it contains [C] which is not for signing. I think I should use the subkey with [S] but how do I use it? I don't know how to get its ID. gpg -k does not show their IDs

7
  • When you specify a masterkey (or userid) gpg automatically uses the appropriate subkey. Your problem is not usage, it is accessing the secret key. Try gpg -K with uppercase K (equivalent to --list-secret-keys instead of --list-keys) and also check you don't have pinentry set to something that doesn't work. Although you don't need the subkey id, you can see it (though not fingerprint) with --keyid-format=long or --keyid-format=short. Jul 30 at 1:37
  • @dave_thompson_085 how should I access the subkey then? It's on a yubikey. I can login to SSH using this yubikey without any problems, but I can't use it for signing as you see
    – Rafaelo
    Jul 30 at 9:05
  • Okay, being on yubikey makes a big difference. Does gpg -K show > or # after ssb for the [S] key (and for [A] which is used for ssh, if you set ssh to go through gpg-agent and scdaemon)? Jul 31 at 5:15
  • it shows ssb# rsa4096 2020-03-02 [S] [expires: 2024-03-01] ssb# rsa4096 2020-03-02 [E] [expires: 2024-03-01] ssb> rsa4096 2020-03-02 [A] [expires: 2024-03-01]
    – Rafaelo
    Aug 1 at 20:09
  • Please put that in the Q where it can be formatted correctly and seen by others, since I know little about yubikey and can't help much more. this and this do confirm ssb> means it is on the card (and usable) while ssb# means it is unusable or missing. But you'll need someone else for why it is unusable. Good luck. Aug 1 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.