On 06/01/2026 08:50, Werner Koch via Gnupg-users wrote:
Hi!
Is there a known way to encrypt multiple/all private keys in the
keyring with a single smart card?
Do you mean to replace the passphrase by some kind of encryption using a
smartcard? This is not possible but it may be worth to discuss such an
option.
Using one card per identity is cost and convenience prohibitive.
In theory you can create several *PGP keys with the same physical key
on the smartcard. But there are some problems. It is better to use
smartcard which allows to store/create several keys and not just the 3
keys we specified for the OpenPGP card. An updated specification of the
OpenPGP card will support more keys.
The drawback of this all is that smartcards may build up a defect and you
would loose access to all your private keys.q
Shalom-Salam,
Werner
One portable solution that might be put into a future gpg 2.x version would be
to allow encrypting the locally stored private keys using a private mail
encryption (not signing) key on any otherwise supported card. For example,
if some OpenPGP cards support storing the private mail decryption key on the
card, then this (future) feature could use that key to decrypt further keys
stored locally in the .gnupg directory.
A special consideration for such a new encryption format would be to allow
multiple ways to decrypt one private key file portion, such as OpenPGP card 1,
OpenPGP card 2(spare), extra secret backup password (stored in a never opened
envelope in an armoured safe). Each of those methods would decrypt a
separately encrypted file-portion encryption key, changing that key would
encrypt the new key to the public keys of each authorized card AND the backup
password (or an intermediary private key encrypted with the password to keep
the envelope sealed).
Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded
_______________________________________________
Gnupg-users mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-users
