Hi there!
I am encountering a certain warning regarding my ed25519/cv25519
encryption key. When I export the freshly generated encryption subkey
and then reimport it, I get the following:
>gpg: Schlüssel 20628B8C51751C49: "some name <some@email.domain>"
>nicht geändert
>gpg: warning: lower 3 bits of the secret key are not cleared
>gpg: Um 'secring.gpg' zu migrieren sollte für jede Smartcard "gpg
>--card-status" aufgerufen werden.
>gpg: Schlüssel 20628B8C51751C49: geheimer Schlüssel importiert
Excuse the German (I'm a learner). Conveniently, the warning is left
untranslated.
The key looks like this - the cv25519 [E] key being the culprit:
gpg2 --list-keys
> /home/patriv/.gnupg/pubring.kbx
> -----------------------------------------------------
> pub ed25519 2022-08-22 [C]
> 52777B22E1A9F815C6112F1420628B8C51751C49
> uid [ ultimativ ] some name <some@email.domain>
> sub ed25519 2022-08-22 [S] [verfällt: 2023-08-22]
> sub ed25519 2022-08-22 [A] [verfällt: 2023-08-22]
> sub cv25519 2022-08-22 [E] [verfällt: 2023-08-22]
I think this was discussed in GnuPG-bug-id:T5464 [1]. I don't know
what to do in order to generate a correct, unencumbered encryption
key.
[1] https://dev.gnupg.org/T5464
Some more info for the curious attached below,
~Patrizio
[Reproduction steps]
gpg2 --version
>gpg (GnuPG) 2.3.3
>libgcrypt 1.9.4
# Generate keys
gpg2 --expert --full-generate-key
>11, s, q, 1, 0, y, some name, some@email.domain, ENTER, <passphrase>, confirm
gpg2 --expert -edit-key some@email.domain
>addkey, 10, 1, 1y, y, y, <passphrase>
>addkey, 11, s, a, q, 1, 1y, y, y, <passphrase>
>addkey, 12, 1, 1y, y, y, <passphrase>
# Back up keys
gpg2 --export --export-options backup --output pub.gpg some@email.domain
gpg2 --export-secret-keys --export-options backup --output sec.gpg some@email.domain
gpg2 --export-secret-subkeys --export-options backup --output sub.gpg some@email.domain
gpg2 --export-ownertrust > otrust.txt
# Delete keys (because I want to import only the subkeys)
gpg2 --delete-secret-and-public-keys some@email.domain
# Import only the subkeys
gpg2 --import --import-options restore sub.gpg
<message with the key bits warning from above>
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
https://lists.gnupg.org/mailman/listinfo/gnupg-users
I am encountering a certain warning regarding my ed25519/cv25519
encryption key. When I export the freshly generated encryption subkey
and then reimport it, I get the following:
>gpg: Schlüssel 20628B8C51751C49: "some name <some@email.domain>"
>nicht geändert
>gpg: warning: lower 3 bits of the secret key are not cleared
>gpg: Um 'secring.gpg' zu migrieren sollte für jede Smartcard "gpg
>--card-status" aufgerufen werden.
>gpg: Schlüssel 20628B8C51751C49: geheimer Schlüssel importiert
Excuse the German (I'm a learner). Conveniently, the warning is left
untranslated.
The key looks like this - the cv25519 [E] key being the culprit:
gpg2 --list-keys
> /home/patriv/.gnupg/pubring.kbx
> -----------------------------------------------------
> pub ed25519 2022-08-22 [C]
> 52777B22E1A9F815C6112F1420628B8C51751C49
> uid [ ultimativ ] some name <some@email.domain>
> sub ed25519 2022-08-22 [S] [verfällt: 2023-08-22]
> sub ed25519 2022-08-22 [A] [verfällt: 2023-08-22]
> sub cv25519 2022-08-22 [E] [verfällt: 2023-08-22]
I think this was discussed in GnuPG-bug-id:T5464 [1]. I don't know
what to do in order to generate a correct, unencumbered encryption
key.
[1] https://dev.gnupg.org/T5464
Some more info for the curious attached below,
~Patrizio
[Reproduction steps]
gpg2 --version
>gpg (GnuPG) 2.3.3
>libgcrypt 1.9.4
# Generate keys
gpg2 --expert --full-generate-key
>11, s, q, 1, 0, y, some name, some@email.domain, ENTER, <passphrase>, confirm
gpg2 --expert -edit-key some@email.domain
>addkey, 10, 1, 1y, y, y, <passphrase>
>addkey, 11, s, a, q, 1, 1y, y, y, <passphrase>
>addkey, 12, 1, 1y, y, y, <passphrase>
# Back up keys
gpg2 --export --export-options backup --output pub.gpg some@email.domain
gpg2 --export-secret-keys --export-options backup --output sec.gpg some@email.domain
gpg2 --export-secret-subkeys --export-options backup --output sub.gpg some@email.domain
gpg2 --export-ownertrust > otrust.txt
# Delete keys (because I want to import only the subkeys)
gpg2 --delete-secret-and-public-keys some@email.domain
# Import only the subkeys
gpg2 --import --import-options restore sub.gpg
<message with the key bits warning from above>
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
https://lists.gnupg.org/mailman/listinfo/gnupg-users
