Closed alex-u410 closed 5 months ago
The problem was two-fold:
KEYTOCARD
. I should have been using e.g. KEYTOCARD 6D886491D5771C42D8ADF0BE748E79B86F7D8B4E D2760001240100000006199714170000 OPENPGP.1 20240304T204544 03010A09
Hope this helps someone! I will close the issue as it is unrelated to this repo :)
Hello, I am trying to generate a ed+cv25519 signing+encryption key on a smartcard. When I push the keys to the smartcard using
gpg-connect-agent
, the encryption subkey fingerprint gets mutated relative to the one in my keyring.Here is my debugging code to create an entity and output a secret key file
I load that key into my keyring and get the fingerprints + keygrips
The fingerprints from the file match the ones in my keyring, as expected.
I then load the keys to the card:
However, when I run
gpg --card-status
, I see the following fingerprints:The signature key's fingerprint matches the one in my keyring, but the encryption subkey does not.
If I instead generate a key with gpg, both fingerprints stay the same when loading to a smartcard:
This behavior indicates some discrepancy being created in the
go-crypto
serialized secret file, like perhaps a field is not getting set, and then gets set bygpg-connect-agent
when loading. However, I've tried a lot of different flags and the depth ofEntity
configuration is a bit dizzying so I thought I'd see if any of the maintainers have thoughts here.A few notes:
go-crypto
specifically to feed curated entropy into the rand reader, as I can find no way to do this with gpg. I need my gpg keys to be determinsiticAny help would be appreciated! Hopefully I've just overlooked something obvious in the configuration.