Skip to content
This repository has been archived by the owner on Jun 12, 2024. It is now read-only.
This repository has been archived by the owner on Jun 12, 2024. It is now read-only.

OpenPGP: Support --export-secret-subkeys (subkeys without primary key) #336

Open

Description

GPG allows you to export your subkeys with with a blank primary key using the gpg --export-secret-subkeys {key-id} option. This is great if you want to keep your primary key air-gapped and have both a signing and encryption subkeys.

Unfortunately, end-to-end raises a "Cannot get key from special locations!" error when trying to import just the subkeys.

Use case:

  1. I have my primary key air-gapped on another computer or on a smart card.
  2. I receive an encrypted email with my public encryption subkey (as is normal).
  3. I want to be able to decrypt the email using end-to-end.

Reproduction steps:

  1. gpg --gen-key
  2. gpg --export-secret-subkeys > secret_subkeys.gpg
  3. Try to import secret_subkeys.gpg into the end-to-end keyring.
  4. See an error "Cannot get key from special locations!"

What should happen:

When importing secret keys, blank primary keys should be skipped and still allow importing secret subkeys. That way, you can still decrypt and read messages sent to you without having to trust end-to-end with your primary secret key.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions