Mailing List Archive: GnuPG: users

Decryption with OpenPGP card fails

Index | Next | Previous | View Threaded

edmond at systemli

Apr 28, 2012, 3:06 AM

Post #1 of 4 (336 views)
Permalink

Decryption with OpenPGP card fails

Hello, I am facing problems decrypting data with my OpenPGP v2 card.
Signing however is working just fine. I have collected the following
output. The PIN retry counter looks a bit weird, could that be the problem?

--------------------
$ echo Test >foo.txt
$ gpg2 --default-key 0xF3D84563 --armor -es -r edmond [at] systemli foo.txt
$ gpg2 --decrypt foo.txt.asc
gpg: encrypted with 4096-bit RSA key, ID 89D322C9, created 2012-03-18
"Edmond <edmond [at] systemli>"
gpg: public key decryption failed: General error
gpg: decryption failed: No secret key

[.I don't get asked for a PIN when signig because it is still cached by
gpg-agent.]
--------------------
$ gpg2 --list-keys edmond [at] systemli
pub 1024D/F3D84563 2009-12-03
uid Edmond <edmond [at] systemli>
uid Edmond <edmond [at] riseup>
uid Kalle Blomquist <zartbitter [at] riseup>
sub 4096g/B9112F3F 2009-12-03 [expires: 2012-04-30]
sub 2048D/25782A52 2011-05-22 [expires: 2012-04-30]
sub 2048R/CD72BB15 2012-03-18 [expires: 2013-03-18]
sub 4096R/89D322C9 2012-03-18 [expires: 2013-03-18]
--------------------
$ gpg2 --card-status
Application ID ...: [removed by Edmond]
Version ..........: 2.0
Manufacturer .....: ZeitControl
Serial number ....: [removed by Edmond]
Name of cardholder: [not set]
Language prefs ...: en
Sex ..............: unspecified
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: forced
Key attributes ...: 2048R 4096R 4096R
Max. PIN lengths .: 32 32 32
PIN retry counter : 3 0 3
Signature counter : 13
Signature key ....: 7723 B3A9 82EC 5035 A00F 0931 DD1C 8306 CD72 BB15
created ....: 2012-03-18 08:44:51
Encryption key....: AEF8 F0EA 8B13 29F1 F370 E324 F105 21FD 89D3 22C9
created ....: 2012-03-18 08:47:00
Authentication key: 8E6F 4404 3CA3 3212 8801 61A3 DC13 CEC0 056B 9E3C
created ....: 2012-01-05 12:36:35
General key info..: pub 2048R/CD72BB15 2012-03-18 Edmond
<edmond [at] systemli>
sec 1024D/F3D84563 created: 2009-12-03 expires: never
ssb 4096g/B9112F3F created: 2009-12-03 expires: 2012-04-30
ssb> 2048R/6703B033 created: 2010-07-13 expires: 2011-07-13
card-no: [removed by Edmond]
ssb 2048D/25782A52 created: 2011-05-22 expires: 2012-04-30
ssb> 2048R/CD72BB15 created: 2012-03-18 expires: 2013-03-18
card-no: [removed by Edmond]
ssb> 4096R/89D322C9 created: 2012-03-18 expires: 2013-03-18
card-no: [removed by Edmond]
--------------------
$ gpg2 --version
gpg (GnuPG/MacGPG2) 2.0.19
libgcrypt 1.5.0
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: ~/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
CAMELLIA128,
CAMELLIA192, CAMELLIA256
Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2
--------------------

Any help appreciated :)

Edmond

_______________________________________________
Gnupg-users mailing list
Gnupg-users [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-users

wk at gnupg

Apr 29, 2012, 2:22 AM

Post #2 of 4 (315 views)
Permalink

Re: Decryption with OpenPGP card fails [In reply to]

On Sat, 28 Apr 2012 12:06, edmond [at] systemli said:
> Hello, I am facing problems decrypting data with my OpenPGP v2 card.
> Signing however is working just fine. I have collected the following
> output. The PIN retry counter looks a bit weird, could that be the problem?

The "3 0 3" are just fine. The 0 is for backward compatibility with 1.x
cards.

> $ gpg2 --decrypt foo.txt.asc
> gpg: encrypted with 4096-bit RSA key, ID 89D322C9, created 2012-03-18
> "Edmond <edmond [at] systemli>"
> gpg: public key decryption failed: General error

I assume that your gpg-agent and scdaemon are also from 2.0.19. That
should indeed work. To debug this you should enable debugging for
scdaemon by putting the lines

debug 1024
log-file /foo/mylog.log

into ~/.gnupg/scdaemon.conf

This will show what gpg-agent sends to scdameon. If it does not sent
anything, you can do the same for gpg-agent.conf. Still nothing? Add a
line

debug 2048

to scdaemon.conf and you will see all the data passing to and from the
card. This also shows the PIN and other information from the card; thus
you better edit the file before posting.

Salam-Shalom,

Werner

--
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.

_______________________________________________
Gnupg-users mailing list
Gnupg-users [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-users

edmond at systemli

Apr 29, 2012, 2:50 AM

Post #3 of 4 (314 views)
Permalink

Re: Decryption with OpenPGP card fails [In reply to]

Hello Werner!

On 29/4/2012 11:22, Werner Koch wrote:
> I assume that your gpg-agent and scdaemon are also from 2.0.19.

Yes, they are.

> To debug this you should enable debugging for
> scdaemon by putting the lines
>
> debug 1024
> log-file /foo/mylog.log
>
> into ~/.gnupg/scdaemon.conf

This only gives:
--------------------
scdaemon[11960]: chan_7 <- SERIALNO openpgp
scdaemon[11960]: chan_7 -> S SERIALNO D276000124010200000500000FD90000 0
scdaemon[11960]: chan_7 -> OK
scdaemon[11960]: chan_7 <- RESTART
scdaemon[11960]: chan_7 -> OK
--------------------
when trying to decrypt.

> debug 2048

Output attached to this message.

> This also shows the PIN and other information from the card; thus
> you better edit the file before posting.

I don't even get to enter my PIN, so I guess this is not an issue here :)

Best,

Edmond

Attachments:

scdaemon.log.txt (7.14 KB)

edmond at systemli

Apr 29, 2012, 3:05 AM

Post #4 of 4 (315 views)
Permalink

Re: Decryption with OpenPGP card fails [In reply to]

On 29/4/2012 11:22, Werner Koch wrote:
> debug 2048

I just realized that after invoking gpg2 --card-status, a gpg2 --decrypt
command does not send anything to the card at all (i.e. no new entries
in the log file)

Edmond

_______________________________________________
Gnupg-users mailing list
Gnupg-users [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads