search

Yubico / ykneo-openpgp

OpenPGP applet for the YubiKey NEO
https://developers.yubico.com/ykneo-openpgp/
GNU General Public License v2.0
214 stars 67 forks source link

failed importing my gpg keys #14

Closed ulrichard closed 10 years ago

ulrichard commented 10 years ago

Maybe I'm doing something wrong, but I did my best in following the advice from README.gpgkeytoneo. here is what I get:

$ python keyParser.py a 5A097EF6 12345678
We cannot handle encrypted secret keys. Skipping!
unable to load private Key
3074283784:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:
EXPECTING: ANY PRIVATE KEY
deadly error modulus

This happens for all three sub keys. The fact that I can successfully export them suggests that the keys themselves are ok.

$ gpg --export-secret-keys 5A097EF6 > auth.asc
$ gpg --version
gpg (GnuPG) 1.4.14

Maybe this information is also of value. I created the keys according to this recipe: http://ncommander.blogspot.ch/2009/08/so-after-having-my-trusty-sony-vaio-do.html I also have them on a crypto stick. But for the neo, I got the .gnupg directory like it was before the initial transfer to the other card. So all the private keys are still in the gpg files.

bricewge commented 10 years ago

I never tried to use keyParser.py. But it work well with gpg keytocard command. Here is a pretty good tutorial that worked for me. Watch out that your keys looks like this:

sub 1024R/41320871 created: 2013-06-08 expires: 2014-06-08 usage: S
sub 1024R/B47AED2F created: 2013-06-08 expires: 2014-06-08 usage: E
sub 1024R/4495E34E created: 2013-06-08 expires: 2014-06-08 usage: A

And that your key is at most a 2048 RSA.

ulrichard commented 10 years ago

Am I right that I have to use a patched, self compiled version of gpg? Every stock version of gpg or gpg2 that I tried so far, refused to move the keys to the yubikey, while it was never a problem with the CryptoStick. What exact version would I have to use to compile my custom gpg? I followed https://github.com/Yubico/ykneo-openpgp/pull/10 but there seems to be no answer on the gnupg mailing list to the suggested patch.

bricewge commented 10 years ago

I nerver used a self compiled patched version of gpg to import keys. I just waited for the merge which happen in GnuPG 2.0.22. So try to find this version from your favorite linux distro repository or compil GnuPG 2.0.22. There is no respond in the mailing list but you can see the commit here.

ulrichard commented 10 years ago

That was the information I needed. Ubuntu saucy ships pgp2.20. So I grabed pgp2.22 from the trusty repository.