为什么 GPG 可以签署消息但不能签署密钥?

信息安全 gnupg 智能卡 优比键
2021-08-20 20:45:41

我正在尝试将本地签名添加到我的密钥环中的一些公钥中,但使用gpg --lsign-key失败并显示“无密钥”消息,尽管事实上gpg --sign有效。我使用 Yubikey 作为智能卡。

GPG 显示密钥不可用,但附加的智能卡上有签名密钥:

$ gpg --list-secret-keys
sec#  rsa4096/0xDEADBEEFDEADBEEF 2000-01-01 [SC]
      Key fingerprint = DEAD BEEF DEAD BEEF DEAD  BEEF DEAD BEEF DEAD BEEF
uid                   [ultimate] My Name <me@example.com>
ssb>  rsa4096/0x8BADF00D8BADF00D 2000-01-01 [E] [expires: 2020-12-31]
ssb>  rsa4096/0xBADDCAFEBADDCAFE 2000-01-01 [S] [expires: 2020-12-31]
ssb>  rsa4096/0xFACEFEEDFACEFEED 2000-01-01 [A] [expires: 2020-12-31]

我可以签署一条消息:

$ echo "test" | gpg --sign --armor
gpg: using "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF" as default secret key for signing
-----BEGIN PGP MESSAGE-----

[snipped signature]
-----END PGP MESSAGE-----

但我不能--lsign-key

$ gpg --lsign-key product-security@apple.com

pub  rsa4096/0x782F6D86DED32B71
     created: 2018-08-20  expires: 2019-08-20  usage: SC
     trust: marginal      validity: unknown
sub  rsa4096/0x1C3F44E9CB9F9E3A
     created: 2018-08-20  expires: 2019-08-20  usage: E
[ unknown] (1). Apple Product Security <product-security@apple.com>
[ unknown] (2)  Apple Product Security Notifications <product-security-noreply@lists.apple.com>

Really sign all user IDs? (y/N) y
gpg: using "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF" as default secret key for signing

pub  rsa4096/0x782F6D86DED32B71
     created: 2018-08-20  expires: 2019-08-20  usage: SC
     trust: marginal      validity: unknown
 Primary key fingerprint: 0CD5 C954 D089 2440 1598  9759 782F 6D86 DED3 2B71

     Apple Product Security <product-security@apple.com>
     Apple Product Security Notifications <product-security-noreply@lists.apple.com>

This key is due to expire on 2019-08-20.
Are you sure that you want to sign this key with your
key "My Name <me@example.com>" (0xDEADBEEFDEADBEEF)

The signature will be marked as non-exportable.

Really sign? (y/N) y
gpg: signing failed: No secret key
gpg: signing failed: No secret key

Key not changed so no update needed.

如何向此密钥添加签名以对其进行验证?

1个回答

签名和密钥签名由不同的子密钥完成。你有:

$ gpg --list-secret-keys
sec#  rsa4096/0xDEADBEEFDEADBEEF 2000-01-01 [SC]
      Key fingerprint = DEAD BEEF DEAD BEEF DEAD  BEEF DEAD BEEF DEAD BEEF
uid                   [ultimate] My Name <me@example.com>
ssb>  rsa4096/0x8BADF00D8BADF00D 2000-01-01 [E] [expires: 2020-12-31]
ssb>  rsa4096/0xBADDCAFEBADDCAFE 2000-01-01 [S] [expires: 2020-12-31]
ssb>  rsa4096/0xFACEFEEDFACEFEED 2000-01-01 [A] [expires: 2020-12-31]

在这里,DEADBEEF是整个PGP密钥的密钥,有效期为小号igning和Ç ertifying。

然后,你有三个子项(SSB =秘密子项),有效期为ē ncryption,ş igning和一个uthentication分别为(你可以如,有一个子项有效的签名和认证,但这些都在不同的密钥对你)。

当你gpg --sign,你正在使用BADDCAFE,而对于gpg --lsign-key你,你会需要DEADBEEF这就是为什么一个有效而另一个无效的原因。

现在,我不确定它为什么会失败,可能DEADBEEF根本不存在(你有完整密钥的离线备份吗?),或者可能是与智能卡交互时的错误,它是“没有找到它”,尽管它确实存储在那里。一个容易审查的事情是您的智能卡支持的插槽数量,因为在其中一些您甚至没有足够的插槽用于这四个键。