Deleting a smart card secret key stub from the secret keyring

[Wouter Verhelst]

Hi,

I recently bought an OpenPGP smart card, and am now evaluating before
deciding whether to move my secret key to the card. To that end, I've
generated (and destroyed, by way of "gpg2 --edit-card"'s factory-reset
command) a number of keys.

However, I noticed that the factory-reset doesn't delete the secret key
stub from my secret keyring; and now I get this:

***@gangtai:~$ LC_ALL=C gpg2 --delete-secret-key b36c8212
gpg (GnuPG) 2.1.11; Copyright (C) 2016 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.


sec rsa4096/B36C8212 2016-04-02 Wouter Verhelst (Debian)
<***@debian.org>

Delete this key from the keyring? (y/N) y
This is a secret key! - really delete? (y/N) y
gpg: deleting secret key failed: Not possible with a card based key
gpg: deleting secret subkey failed: Not possible with a card based key
gpg: deleting secret subkey failed: Not possible with a card based key
gpg: b36c8212: delete key failed: Not possible with a card based key

How do I tell GnuPG that this secret key is no longer in existence, and
that it should remove it from its list of secret keys? I've removed it
from the card, and I didn't create a backup copy (since this was only a
test key, after all).

I suppose I could just wipe out my entire secret keyring, but I'd rather
not do that, since it contains my production GPG keys...

[Werner Koch]

Post by Wouter Verhelst
How do I tell GnuPG that this secret key is no longer in existence, and
that it should remove it from its list of secret keys? I've removed it

gpg --with-keygrip -k b36c8212

Which gives you a /Keygrip/. For a card based key gpg-agent creates a
file

~/.gnupg/private-keys-v1.d/KEYGRIP.key

to store public key parameters and the serial number of the card,. so
that gpg-agent can ask you to insert the card it wants to use. Just
delete that file, howeverit will e re-created whe you insert a card.

gpg-connect-agent 'keyinfo --list' /bye

prints a list of all keys known by gpg-agent with additional
information.

gpg-connect-agent 'help keyinfo' /bye

documents the used output format.


Shalom-Salam,

Werner

[Wouter Verhelst]

Post by Werner Koch

Post by Wouter Verhelst
How do I tell GnuPG that this secret key is no longer in existence, and
that it should remove it from its list of secret keys? I've removed it

gpg --with-keygrip -k b36c8212
Which gives you a /Keygrip/. For a card based key gpg-agent creates a
file
~/.gnupg/private-keys-v1.d/KEYGRIP.key
to store public key parameters and the serial number of the card,. so
that gpg-agent can ask you to insert the card it wants to use. Just
delete that file,

Thanks, that worked.

Post by Werner Koch
howeverit will e re-created whe you insert a card.

Presumably, when I insert the card with the same key?