6

i am getting this error while importing a public key on gpg (GnuPG) 1.4.2

gpg: armor header: Version: GnuPG v2.0.14 (GNU/Linux)
gpg: pub  xxxxx/xxxxxxxx 2012-05-25  abcd xyz <email@address.com>
gpg: DSA requires the use of a 160 bit hash algorithm
gpg: DSA requires the use of a 160 bit hash algorithm
gpg: key xxxxxxxx: invalid self-signature on user ID "abcd xyz <email@address.com>"
gpg: DSA requires the use of a 160 bit hash algorithm
gpg: DSA requires the use of a 160 bit hash algorithm
gpg: key xxxxxxxx: invalid subkey binding
gpg: key xxxxxxxx: skipped user ID "abcd xyz <email@address.com>"
gpg: key xxxxxxxx: skipped subkey
:pg: key xxxxxxxx: no valid user IDs
gpg: this may be caused by a missing self-signature
gpg: Total number processed: 1
gpg:           w/o user IDs: 1

Even after adding "allow-non-selfsigned-uid" in my options file. gpg say its not safe to encrypt using this key. Is there anything the we must do during exporting the public key to fix this ?

5

It might also be a version conflict: The key (originating from gpg v2.x) may have some feature old 1.4 series gpg doesn't understand.

(Similar, misleading error messages are given if you try to feed a pre-2.1 gpg with an elliptic curve key that you can create using gpg --expert in version 2.1 or newer.)

1
  • 2
    Not sure why you were downvoted. This was precisely my problem. The solution? Running the import with gpg2 instead of gpg made it much easier to import my ECC key into the new computer! – kqr Jan 18 '18 at 14:19
4

gpg requires a valid signature issued by the key owner - this is important because it binds the user description and e-mail address to the actual public key; otherwise, this information could be arbitrarily modified. This self-signature seems to be broken, thus gpg refuses to use the key.

1

gpg (GnuPG) 1.x.x only supports up to DAS1024. Any RSA key will however work.

The error "gpg: DSA requires the use of a 160 bit hash algorithm" will be thrown when trying to import a DSA2048 key where RSA2048 and even RSA4096 will work.


To check is public key is compliant with version 1.x:

> gpg --list-packet {key.pub}|grep -A2 "public sub key packet"

:public sub key packet:
        version 4, algo 1, created 1560364275, expires 0
        pkey[0]: [2048 bits]

Command will return Algo on first line where the 2 listed here can be selected with keys are generated (ref: Public-Key Algorithms).


ID Algorithm

== =========

1 - RSA (Encrypt or Sign) [HAC]

17 - DSA (Digital Signature Algorithm) [FIPS186] [HAC]


If algo 17 is returned, gpg (GnuPG) 1.x.x will only support up to 1024 bits (second line returned with the above command).

Please note that any Algorithm of any size are supported with gpg (GnuPG) 2.x.x

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy