我最近得到了一个 Yubikey 并按照说明将密钥加载到上面这里。 gpg 成功读写卡，我可以从中看到密钥指纹。但是，当我尝试使用gpg --edit-cardthenfetch来获取密钥存根时，没有任何反应。没有错误，但我的钥匙也没有出现。
当我检查时journalctl -f，有一条消息来自dirmngr：
Apr 14 12:02:25 {snip} gpg-agent[1816]: card has S/N: D27{...snip...}0000
Apr 14 12:02:33 {snip} dirmngr[1823]: command 'KS_GET' failed: Server indicated a failure <Unspecified source>
man gpg将我发送到 gnupg.org 文档，其中提供了将密钥传输到卡的说明（第 5.2.2 节），但只说“您可以按照通常的方式对文件进行签名、解密和加密”。我的最终目标是用于pass安全地存储密码，但是当我尝试以通常的方式使用它时，我看到了gpg: decryption failed: No secret key。
我应该采取什么不同的做法？
我正在使用gnupg主存储库中的 Arch Linux 版本 2.2.15-1。
作为参考，这里是我的 gpg 会话的完整列表：
$ gpg --list-secret-keys
$ gpg --list-keys
$ gpg --edit-card
Reader ...........: 1050:0407:X:0
Application ID ...: D27{...snip...}0000
Version ..........: 2.1
Manufacturer .....: Yubico
Serial number ....: 0{...snip...}6
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: not forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3
Signature counter : 0
Signature key ....: 8DD5 {...snip...} C8B3
created ....: 2019-04-13 23:49:11
Encryption key....: B9B0 {...snip...} 9B22
created ....: 2019-04-13 23:49:11
Authentication key: 6447 {...snip...} 21C0
created ....: 2019-04-13 23:53:30
General key info..: [none]
gpg/card> fetch
gpg/card> quit
$ gpg --list-secret-keys
$ gpg --list-keys
答案1
GPG 智能卡迷你操作指南
简答
看来密钥已正确复制到 Yubikey 智能卡上。但是，本地密钥环中缺少公钥。为了使 gpg 正常工作，公钥必须在本地可用。
有多种方法可以导入公钥。然而，智能卡上有一个方便的字段，用于存储可以找到公钥的 URL。因此，如果公钥放置在 Internet 上可公开访问的位置，则可以使用菜单fetch中的选项gpg/card或--fetch-keys URLgpg 命令行上的选项来检索公钥并将其添加到本地密钥环。
一旦本地密钥环知道公钥，存储在智能卡上的私钥就应该使用设置的用户密码正常运行来解锁密钥。
迷你操作指南
本教程将介绍无密码 PGP 密钥集的创建、在智能卡上加载密钥、在 Internet 上发布公钥以及卡的基本使用。
请注意，本文中包含的密钥只是测试和演示密钥。它没有密码，如果需要，可以通过复制和粘贴在本地导入。但是，请不要将此测试密钥用于除测试之外的任何目的。
GPG版本
gpg --version
gpg (GnuPG) 2.2.12 libgcrypt 1.8.4
密钥生成
让我们生成一个可以使用的密钥：
$ cat << EOF | gpg --gen-key --batch -
> Key-Type: rsa
> Key-Length: 2048
> Key-Usage: sign
> Subkey-Type: rsa
> Subkey-Length: 2048
> Name-Real: demo card
> Name-Comment: DeleteMe
> Name-Email: [email protected]
> %no-protection
> %commit
> EOF
这是秘密密钥
gpg --armor --export-secret-key [email protected]
-----BEGIN PGP PRIVATE KEY BLOCK-----
lQEmBFy0xCUBCAC4WZl7y5QYe7k8g1/JV21hrvgE7A1LWFbCnX8CP35poGfUfJEz
/GB7s0j1D9nvQIse2QOfQQO+f9rJOfiB4Cc7vqXZghFS0lESgluK4M9ygQJwizvt
yJG0517zD3sKeqBO19EB4ElEPkcvQRrbKvPLXlL7mdjIGPpmIdSZh7u+28Qedv6a
2d7WHXXH7dfVDt5izRxn9ar9qyGO54AIHmHJ0O2RyPW8kaYsRESdHs2klbHtHN+n
mvV85+jQ7DABh3A8VlaMtXLRNt79osUSNPLiUh8ZltXcbb3flwCVrRxR2cQBN9P/
qoOFhkTe92RipUQENr5CEeK2t+Zk64JQfSLPABEBAAH/AGUAR05VAhDSdgABJAEC
AXYVAAAAGQAAtCtkZW1vIGNhcmQgKERlbGV0ZU1lKSA8ZGVtby5jYXJkQGRvbWFp
bi50bGQ+iQFOBBMBCgA4FiEE9Epupl6CF0Nug+LC8WY6apR5OYcFAly0xCUCGwMF
CwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ8WY6apR5OYfZBwf+LGeEA0zJlzdC
WGuZ3lRJoeLRaLgUNy6ZatJMudggE5u2yO0omIlaQooLmsqtnNwi5y8W5BzrdYPe
yzkdyZqmfW8IgxlW8n7lngkkVJ44xUI2aMsDRMDH+09Q3bHXihgaDbgwLyXwJe8f
bHByeLD0penL/GscR0vlmp4ZcoxwB6elsJdamhDQgbg2BD/zeomAPwLymsvDZL+5
Q4KpX3iyD7jV0CzM9ApEbhwDJ7RaBaFryz0p0LuZOHKC4f2thPxZ6Q53Qi/k11Er
m+rG35qIG+IfKASCUHzhhz0pVKGzhg3n2YmzupVHFfN8ARA/L3kNDrIuvsQhVHqq
OPq4WPgBY50BJgRctMQlAQgAoA1nDFyGJp63D/WvYurZxovqEjL5fGBD8JOXMiUN
9m8V8NhSFwDHl/p52ZQp/OAA67uuj7UScrsGAVwotTXMyGMnuoEQDE9nRBRbc3zX
XEfXDmpnEv5NqqyBVe0mbkLwN3mbdV/JcQDZo+5TMqWWnboB+kBa3JPJbKydJYjH
2XTzUFGlLAL28ArXCmoBCO1IyCLDJzUUZWuuyTCeTVF5IB3aJ25G3y7I07bK9EyC
smaddDueHoDFv2hrs3vcTW5cVkbzeYil7i8H84Fxsn9InAKBrAdEtN2FEWBripS+
Y7dSGgKpOxFgf6tDB6EbW9UDWebWLrhUgY43WP/A8i15/wARAQAB/wBlAEdOVQIQ
0nYAASQBAgF2FQAAABkAAIkCbAQYAQoAIBYhBPRKbqZeghdDboPiwvFmOmqUeTmH
BQJctMQlAhsuAUAJEPFmOmqUeTmHwHQgBBkBCgAdFiEE63Vmygf/nE+U7ZJGtFWa
qgYkqc8FAly0xCUACgkQtFWaqgYkqc9RkAgAlrFqM69D1a8gm/xYyRGAy/cU3NGr
P8peoA0WpA0xnJCy+ZZdLD33fHrAC0CNjlpkXD2k8KLPCzTrrGwcbjIeR3Rnw5rJ
xkQyDkZmA6qrpFxDopf8oopP6s38bXErHdWhFPn9YLeWTNc8hVLOrHck2OvbXw2G
PQc4ULtmGv7FaSaijV7DuC6yZ20k+Kx40V4QyprYlClN++WdaWXban3BxwFMiuhp
Q/TadscHzHzbvEi8XTjYQlhLbvI4IIJTA7K8JbhrUZaniKnPC1gTqSLD320gwpnX
9ZrQPmexzxtkk97ZOWhUmrcK6ZQ767U6umN2tQLnkPmHSkIyfOu4nyfj33i+B/wP
3iwWNOM+CX0vB1FhixeJ4TjuhmLe3rZq264lnC2UuJbiGM/gwJegtR86xAwvcR/l
zuK/kxbAhQko8yNgB2qAjxQNO4DiSgsyWGKbCGcNC6vs9zSiLfe4f+AhfvUyXQ3+
yGmm+mhQgc097TkijMmZMJn/zg/WFVPJb45LRlA15Pg7n5769H1//7QLDZEnBfOx
PAUDGv+S8vZZRE+WE7X4VTnLDWZzCS03iUgHd4YMbcbmijLDwiqK31wqitJBNcDN
em3oWz1wfTioaISSWyxy03SK2Kjj+6zxA/mbZWr4L9pXBRwCVS6QQ3Bgie0kuZSP
NQSlYESEFuIGA3+WuBy2
=V4D1
-----END PGP PRIVATE KEY BLOCK-----
主要清单
gpg --edit-key F1663A6A94793987
Secret key is available.
sec rsa2048/F1663A6A94793987
created: 2019-04-15 expires: never usage: SC
trust: ultimate validity: ultimate
ssb rsa2048/B4559AAA0624A9CF
created: 2019-04-15 expires: never usage: SEA
[ultimate] (1). demo card (DeleteMe) <[email protected]>
将公钥放在网上某处
gpg -a --export F1663A6A94793987
https://pastebin.com/raw/y8gCBFmH
将密钥和 URL 添加到卡中
gpg --edit-card
gpg/card> url
URL to retrieve public key: https://pastebin.com/raw/y8gCBFmH
gpg --edit-key F1663A6A94793987
gpg> keytocard
Really move the primary key? (y/N) y
Please select where to store the key:
(1) Signature key
(3) Authentication key
Your selection? 1
gpg> key 1
sec rsa2048/F1663A6A94793987
created: 2019-04-15 expires: never usage: SC
trust: ultimate validity: ultimate
ssb* rsa2048/B4559AAA0624A9CF
created: 2019-04-15 expires: never usage: SEA
[ultimate] (1). demo card (DeleteMe) <[email protected]>
gpg> keytocard
Please select where to store the key:
(1) Signature key
(2) Encryption key
(3) Authentication key
Your selection? 2
gpg> save
从密钥环中删除密钥
gpg --delete-secret-keys F1663A6A94793987
sec rsa2048/F1663A6A94793987 2019-04-15 demo card (DeleteMe) <[email protected]>
Delete this key from the keyring? (y/N) y
This is a secret key! - really delete? (y/N) y
gpg --delete-keys F1663A6A94793987
pub rsa2048/F1663A6A94793987 2019-04-15 demo card (DeleteMe) <[email protected]>
Delete this key from the keyring? (y/N) y
与OP类似的状态
gpg --edit-card
Reader ...........: 04E6:xx:0
Application ID ...: D27600xxxx0190000
Version ..........: 2.1
Manufacturer .....: unknown
Serial number ....: 00000019
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : https://pastebin.com/raw/y8gCBFmH
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3
Signature counter : 0
Signature key ....: F44A 6EA6 5E82 1743 6E83 E2C2 F166 3A6A 9479 3987
created ....: 2019-04-15 17:49:25
Encryption key....: EB75 66CA 07FF 9C4F 94ED 9246 B455 9AAA 0624 A9CF
created ....: 2019-04-15 17:49:25
Authentication key: [none]
General key info..: [none]
使用卡上的钥匙
检索公钥
gpg/card> fetch
gpg: requesting key from 'https://pastebin.com/raw/y8gCBFmH'
gpg: key F1663A6A94793987: public key "demo card (DeleteMe) <[email protected]>" imported
gpg: Total number processed: 1
gpg: imported: 1
gpg/card> list
Reader ...........: 04E6:xx:0
Application ID ...: D27600xxxx0190000
Version ..........: 2.1
Manufacturer .....: unknown
Serial number ....: 00000019
Name of cardholder: [not set]
Language prefs ...: [not set]
Sex ..............: unspecified
URL of public key : https://pastebin.com/raw/y8gCBFmH
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: rsa2048 rsa2048 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 3 3 3
Signature counter : 0
Signature key ....: F44A 6EA6 5E82 1743 6E83 E2C2 F166 3A6A 9479 3987
created ....: 2019-04-15 17:49:25
Encryption key....: EB75 66CA 07FF 9C4F 94ED 9246 B455 9AAA 0624 A9CF
created ....: 2019-04-15 17:49:25
Authentication key: [none]
General key info..:
pub rsa2048/F1663A6A94793987 2019-04-15 demo card (DeleteMe) <[email protected]>
sec> rsa2048/F1663A6A94793987 created: 2019-04-15 expires: never
card-no: 7615 00000019
ssb> rsa2048/B4559AAA0624A9CF created: 2019-04-15 expires: never
card-no: 7615 00000019
即将可用
gpg --edit-key F1663A6A94793987
Secret key is available.
sec rsa2048/F1663A6A94793987
created: 2019-04-15 expires: never usage: SC
card-no: 7615 00000019
trust: unknown validity: unknown
ssb rsa2048/B4559AAA0624A9CF
created: 2019-04-15 expires: never usage: SEA
card-no: 7615 00000019
[ unknown] (1). demo card (DeleteMe) <[email protected]>
密钥信任发生了什么？
GPG 将信任与密钥材料分开存储。这种信任设置使信任网。因此，当将给定密钥导入本地密钥环时，不会为该密钥分配信任级别。然而，这很容易交互式地改变。
gpg --edit-key F1663A6A94793987
gpg> trust
sec rsa2048/F1663A6A94793987
created: 2019-04-15 expires: never usage: SC
card-no: 7615 00000019
trust: unknown validity: unknown
ssb rsa2048/B4559AAA0624A9CF
created: 2019-04-15 expires: never usage: SEA
card-no: 7615 00000019
[ unknown] (1). demo card (DeleteMe) <[email protected]>
Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)
1 = I don't know or won't say
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately
m = back to the main menu
Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y
现在钥匙已完全准备好
gpg --list-key F1663A6A94793987
pub rsa2048 2019-04-15 [SC]
F44A6EA65E8217436E83E2C2F1663A6A94793987
uid [ultimate] demo card (DeleteMe) <[email protected]>
sub rsa2048 2019-04-15 [SEA]
我们来尝试一下
gpg -ear F1663A6A94793987
Hello there!
-----BEGIN PGP MESSAGE-----
hQEMA7RVmqoGJKnPAQf/V5CAzRCQ8gmAczy5i66e6w93CRYDiJ/1fNfL6ey2lYx2
cu/I3I12455Z8YjnLk3q66LW0gkhaxVX1uhtBXgjglz2RX6wMAYSDMvVs4cfIgq4
VLbW8T2y8ThdXvpGfwtgBgfFV5M2QS46RipXeF5rOCOnGeI8IUuzAC2147/qjcHG
+/wWDaker7NfY8GSgJ8OXd6kTmpZ//1zOTYvJVsE80viByv2Hx42Zu0r6e3KqgeR
qQlNA/zevYYjm4S0tkmxYoDb42gTPClNiHkJa3IXYlwYPzLCSszBsaTfHZdHl7yx
8PshF7fmE/NOO0dhHq2cV+fqPq8uT/VlNcPm3TYNxtJIAfnuTuHcorOuQNh0koML
8WWTIlLbj9OfBsZVsy5cp5ggpSLrCdPYd1g7RzEwRxu8QrWNO+pj2VRTtEZMafXq
XsKGJIgxsbJQ
=nwdE
-----END PGP MESSAGE-----
gpg -d
Please unlock the card
Number: 7615 00000019
Holder:
PIN:
gpg: encrypted with 2048-bit RSA key, ID B4559AAA0624A9CF, created 2019-04-15
"demo card (DeleteMe) <[email protected]>"
Hello there!
与使用pass
pass init F1663A6A94793987
mkdir: created directory '/home/user/.password-store/'
Password store initialized for F1663A6A94793987
pass insert password1
Enter password for password1: <qwerty>
Retype password for password1: <qwerty>
pass show password1
Please unlock the card
Number: 7615 00000019
Holder:
PIN:
qwerty
使用说明
如果使用不在卡上的密钥初始化给定的密码存储。如果密钥随后移动到智能卡，则密码脚本将无法找到密钥。