2

I have been attempting to create a system of GPG subkeys to distribute to my various computers. I have created subkey pairs for each computer with the master secret key removed as per the instructions here and here. I have the distributed the relevant .gnupg folders to my computers via scp. I am then testing these by attempting to access my pass database. The keypair folder I sent to my laptop works fine and decrypts my passwords, but the one I sent to another headless system does not, and when I attempt to show a password I get the follwoing error message:

gpg: decryption failed: No secret key

If I try using the same subkey pair .gnupg folder - the one intended for the headless box - on my laptop, it works fine to decrypt.

All systems run Arch Linux and the same versions of gnupg 2.1.8 and pass 1.6.5.

Can anyone suggest why the subkeys don't work to decrypt on my headless system?

Improve this question
  • Have you copied the .gnupg folder to the right user's home directory (the user trying to access the keys) and adjusted the access permissions (user IDs might be different, although user names are similar)? Is showing gpg --version the same directory as homedirectory you transferred? – Jens Erat Oct 19 '15 at 14:18
  • Yes, gpg --version shows the correct directory. I've tried changing the permissions. Can you confirm what they should be? I've used chown -R stephanie:users .gnupg to change to the correct owner and used chown -R 755 .gnupg to change the permissions, but I still get the same error. – stephanie.anderson Oct 20 '15 at 18:14
  • What is gpg --list-secret-keys printing? – Jens Erat Oct 20 '15 at 19:32
  • It seems to show what I'd expect: sec# rsa4096/0xFAEA411332F636B9 2015-10-12 uid [ultimate] Stephanie Anderson <stephanie.anderson.1873@gmail.com> ssb rsa4096/0x1C674CBC250C2765 2015-10-12 ssb rsa4096/0x72D1B3B02E4F1015 2015-10-12 – stephanie.anderson Oct 20 '15 at 21:11
  • I never used pass, so I cannot give you the complete route to get more details. Try to find the OpenPGP encrypted contents, and pipe them into gpg --list-packets, which should give you more details on which key it is expecting. You might also be able to somehow sneak a -v into the GnuPG call, which might add some helpful information on the key it's trying to access. – Jens Erat Oct 20 '15 at 21:15
1

Ok, so it turns out the use of pass was a red herring. I tried simply encrypting a document and then attempting to decrypt it. With the -v flag this showed that the problem was with the pinentry agent. So with the instructions from the answer here. I have now got it working with pinentry-curses.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.