GPG – Error Retrieving Key via WKD

gpg

I am trying to encrypt a file locally and I get an error. me@example.com is a placeholder for my email address, a public key exists for that in my keyring and also on key servers. My private key is located on a hardware key (Yubikey). I can decrypt previously encrypted files with no problem. Here is the error:

➜  ~ gpg -e -r me@example.com somefile.txt 
gpg: error retrieving 'me@example.com' via WKD: General error
gpg: me@example.com: skipped: General error
gpg: somefile.txt encryption failed: General error

What does this error mean and how can I solve it?

P.S. There is only one more thing that might be related. My public key is expired.

Best Answer

Extending key expiration date fixed the problem. The error message was misleading. However adding -vv as Jens Erat suggested produced some useful error messages such as gpg: Note: signature key ... expired and gpg: ... skipped: Unusable public key that helped finding the actual error.

Related Solutions

Gpg: “secret key not available” when sec & pub key are in keyring

Note the error message: it doesn't say that the secret key is missing (it isn't), it says the public key is missing.

gpg: key 71980D35:secret key without public key- skipped

In RSA, some numbers (d, p, q, u) are private and others (n, e) are public. Only the 2 public numbers are required for encryption and signature verification while all 6 numbers are required in order to decrypt and sign. So for the latter operations, you actually need both the secret and public keys.

Did the public key get deleted from the pubring by accident?

You can try re-importing the public key. Since the public key is the one that is distributed widely, it should be easy to re-obtain a copy of it.

Why doesn’t gpg need us to specify which keys for encryption and decryption

GnuPG will use the first key found in the secret keyring if neither --default-user nor --local-user is specified. You may also define the default key to be used with

default-key KEYID

in ~/.gnupg/gpg.conf.

Symmetric encryption does not involve any public or private keys. The passphrase that you enter is used to both encrypt and decrypt the message (hence "symmetric").

In your example, you will not be asked for the passphrase when decrypting because the gpg-agent process has cached the passphrase that you used when encrypting the message. If you terminated the agent and tried to decrypt the message again, you would be asked for the passphrase.

If you share your doc.gpg file and if it's encrypted with symmetric encryption, you would also need to share the passphrase somehow for enabling the recipients to decrypt the message. Anyone with the passphrase would be able to decrypt the message.

When using key encryption with signing, it would be enough to share you public key (for verification of the signature). Without signing, you don't have to share your key. Using key encryption, the message would be encrypted for one or several specific recipients, so you would need to have their public keys to perform the encryption. Without access to the private keys of the specific recipients, the message would not be able to be decrypted.

Best Answer

Related Solutions

Gpg: “secret key not available” when sec & pub key are in keyring

Why doesn’t gpg need us to specify which keys for encryption and decryption

Related Question