This repository has been archived by the owner on Jun 12, 2024. It is now read-only.
This repository has been archived by the owner on Jun 12, 2024. It is now read-only.
OpenPGP: Support --export-secret-subkeys (subkeys without primary key) #336
Open
Description
openedon Aug 26, 2015
GPG allows you to export your subkeys with with a blank primary key using the gpg --export-secret-subkeys {key-id}
option. This is great if you want to keep your primary key air-gapped and have both a signing and encryption subkeys.
Unfortunately, end-to-end raises a "Cannot get key from special locations!" error when trying to import just the subkeys.
Use case:
- I have my primary key air-gapped on another computer or on a smart card.
- I receive an encrypted email with my public encryption subkey (as is normal).
- I want to be able to decrypt the email using end-to-end.
Reproduction steps:
gpg --gen-key
gpg --export-secret-subkeys > secret_subkeys.gpg
- Try to import
secret_subkeys.gpg
into the end-to-end keyring. - See an error "Cannot get key from special locations!"
What should happen:
When importing secret keys, blank primary keys should be skipped and still allow importing secret subkeys. That way, you can still decrypt and read messages sent to you without having to trust end-to-end with your primary secret key.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment