I have been attempting to create a system of GPG subkeys to distribute to my various computers. I have created subkey pairs for each computer with the master secret key removed as per the instructions here and here. I have the distributed the relevant .gnupg folders to my computers via scp. I am then testing these by attempting to access my pass database. The keypair folder I sent to my laptop works fine and decrypts my passwords, but the one I sent to another headless system does not, and when I attempt to show a password I get the follwoing error message:
gpg: decryption failed: No secret key
If I try using the same subkey pair .gnupg folder - the one intended for the headless box - on my laptop, it works fine to decrypt.
All systems run Arch Linux and the same versions of gnupg 2.1.8 and pass 1.6.5.
Can anyone suggest why the subkeys don't work to decrypt on my headless system?
.gnupg
folder to the right user's home directory (the user trying to access the keys) and adjusted the access permissions (user IDs might be different, although user names are similar)? Is showinggpg --version
the same directory as homedirectory you transferred? – Jens Erat Oct 19 '15 at 14:18gpg --version
shows the correct directory. I've tried changing the permissions. Can you confirm what they should be? I've usedchown -R stephanie:users .gnupg
to change to the correct owner and usedchown -R 755 .gnupg
to change the permissions, but I still get the same error. – stephanie.anderson Oct 20 '15 at 18:14gpg --list-secret-keys
printing? – Jens Erat Oct 20 '15 at 19:32sec# rsa4096/0xFAEA411332F636B9 2015-10-12 uid [ultimate] Stephanie Anderson <stephanie.anderson.1873@gmail.com> ssb rsa4096/0x1C674CBC250C2765 2015-10-12 ssb rsa4096/0x72D1B3B02E4F1015 2015-10-12
– stephanie.anderson Oct 20 '15 at 21:11pass
, so I cannot give you the complete route to get more details. Try to find the OpenPGP encrypted contents, and pipe them intogpg --list-packets
, which should give you more details on which key it is expecting. You might also be able to somehow sneak a-v
into the GnuPG call, which might add some helpful information on the key it's trying to access. – Jens Erat Oct 20 '15 at 21:15