[BUG] "No decryption keys found" when importing subkeys-only (stripped primary key) export

[alansav]

Describe the bug

Using a GPG key where the master/primary key is certify-only and kept offline, with only subkeys (signing, encryption, auth) exported via gpg --export-secret-subkeys and imported on-device.

Steps to reproduce

1. Generate a GPG key with certify-only primary + separate sign/encrypt/auth subkeys.
2. Export subkeys only: gpg --export-secret-subkeys --armor > subkeys-only.asc
3. Import subkeys-only.asc into Password Store's internal Key Manager.
4. Key shows correctly in Key Manager (able to view/manage), no import error.
5. Attempt to decrypt an existing password entry.

Expected behavior

Passphrase prompt, then successful decryption.

Screenshots

Immediate "No decryption keys found" error — no passphrase prompt appears at all.

Device information

Android Password Store
GrapheneOS (Pixel 9a)
GPG key: Ed25519 primary (Certify only), cv25519 encryption subkey, Ed25519 signing subkey, Ed25519 auth subkey — generated GnuPG 2.4.x

Additional context

• Directly copying the same .gpg file and decrypting via OpenKeychain (separately installed) succeeds without issue — confirms the encrypted data and the encryption subkey itself are valid and functional.
• Re-exporting with --no-throw-keyids and adjusting key preferences to remove AEAD/OCB (setpref without AEAD) did not resolve the issue — ruling out the known AEAD/PGPainless incompatibility ([BUG] Unhelpful error message on exception during decryption, with gpg 2.40 Curve25519 AEAD android-password-store/Android-Password-Store#2586).
• Importing the full master key (not stripped) into Password Store's Key Manager works correctly and decrypts without issue — isolates the problem specifically to handling of a stripped-primary-key (subkeys-only) import, not the encryption algorithm or key format itself.

[agrahn]

Would you please post an example key here?

[alansav]

Sure: generated an example key and here are the subkeys. Passphrase for it is: bambam

new-subkeys-only.zip

[TonioGela]

Wow, I was about to install the app, but this is quite a stopper. +1 on solving this.

[agrahn]

I cannot import your key neither in APS nor in gpg. The latter says

$ gpg --import new-subkeys-only.asc
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62: no valid user IDs
gpg: this may be caused by a missing self-signature
gpg: Total number processed: 1
gpg:           w/o user IDs: 1
gpg:       secret keys read: 1

while the former says

How did you exactly generate the key?

Here is my stripped key example that works, with all passphrases 12345678:

-----BEGIN PGP PRIVATE KEY BLOCK-----

lDsEakoFARYJKwYBBAHaRw8BAQdAm8s9q56iz9A3htz2Vzh4zYrBWMieXrINugVx
mwgbZAr/AGUAR05VAbQUamFuZS5yb2VAZXhhbXBsZS5jb22IrwQTFgoAVxYhBP92
C97IOLfEehxLF7Q9TCe/KlTABQJqSgUBGxSAAAAAAAQADm1hbnUyLDIuNSsxLjEx
LDMsMgIbAQULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRC0PUwnvypUwG36
AQDACZOZsMEZsNBPd2k6Z1Lrc5OyTHeAbZpGVkrJSleblwEAtznJLb10Wq8rZpps
kKNg5QUGZ8eTN7tqadgghtZivgmchgRqSgWWFgkrBgEEAdpHDwEBB0BcK+HlMoNx
ekqB80sAbkW6u5MxyeYoTQPWMxlofLISPf4HAwKooPQh5H2r8PvL3+PM20z0RPoV
5ck+BV0dPYq1QrMw+gWVpqNGRSHL56bdHzIyXAU6gQOnFTCA/6UNUlAWlpoMSg/1
JNdHbzkztQLtNtfJiQELBBgWCgA8FiEE/3YL3sg4t8R6HEsXtD1MJ78qVMAFAmpK
BZYbFIAAAAAABAAObWFudTIsMi41KzEuMTEsMywyAhsCAIEJELQ9TCe/KlTAdiAE
GRYKAB0WIQSCEpJSRluMxfoz74EASyRH2Uja3gUCakoFlgAKCRAASyRH2Uja3mwX
AP453iv8uGGPhw7ssjMHlBHB3yUxJFH2KNyMc+SxEFYo7QEAnNGuJjhvF+Ha/BN9
VJ9fXp2JRD3wmtoiJns+L1BaIAqG2AEAyAUh/OTIcppQm4RTOVTFz5UQW0AuDgtK
yXw3COvkCcUBAK1ONCDcw+paALLc37wVWSQbnGxf8nX+bGG6eXTPdmUDnIsEakoF
1BIKKwYBBAGXVQEFAQEHQPenYpOvhmGCtFBWx1ZVfs83OmBExDR9FS1t+t5aU4ER
AwEIB/4HAwIqB4zBXV6A8/tsWchNPnjE/sIVwYiqljOl1zClUg0ipWqPRlzNHqN/
cFsD3jowQnLhHrRDWMn3jF90rLMyvpdyKGVD9BZPA2aRtF805wJ5iJQEGBYKADwW
IQT/dgveyDi3xHocSxe0PUwnvypUwAUCakoF1BsUgAAAAAAEAA5tYW51MiwyLjUr
MS4xMSwzLDICGwwACgkQtD1MJ78qVMCW+gEAoVydUKJ4PgyIAlOkj888H0afqQgN
XJDQKUlFBGNkvgkA/RhNCON6RE7uBnmBGHxJwecqsbeHF00oveNBd1marpMAnIYE
akoGMRYJKwYBBAHaRw8BAQdAJQ0t6jNPW28JVJ2GE+AjozbwY88TXL91Uv//uB6y
Ae/+BwMCPEx36v3fl/r7nJj0fP/cAaLHstw9gw1dyMm8Whojb+6zSCs4aSwe2VAO
IvRNrWzl6n67Z+6jPX9QFFiB8V+jbN97tE8wc+ylPJ0SjFbeH4iUBBgWCgA8FiEE
/3YL3sg4t8R6HEsXtD1MJ78qVMAFAmpKBjEbFIAAAAAABAAObWFudTIsMi41KzEu
MTEsMywyAhsgAAoJELQ9TCe/KlTAF/EBAJYHP+Eg4zYptb5Srirz8QNtbHDfTFOg
We2t2cQRyRUwAP9gqPJlxBGwjo2WTKgHcFamX+EqaXo22Jf0U3CewzjHBg==
=4Pwi
-----END PGP PRIVATE KEY BLOCK-----

I started with gpg --quick-generate-key jane.roe@example.com default cert 0 to create the master C key, then added S, E, A subkeys in a gpg --expert --edit-key jane.roe@example.com session.

$  gpg --version
gpg (GnuPG) 2.5.17

[agrahn]

@TonioGela, that's a pitty. But note, that I cannot reproduce the issue, though.

[TonioGela]

@TonioGela, that's a pitty. But note, that I cannot reproduce the issue, though.

I will soon try with my setup, where I have stripped the primary [C] key too

[alansav]

I cannot import your key neither in APS nor in gpg. The latter says

$ gpg --import new-subkeys-only.asc
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62 was created 1030 seconds in the future (time warp or clock problem)
gpg: key 2C51E01A25DCFC62: no valid user IDs
gpg: this may be caused by a missing self-signature
gpg: Total number processed: 1
gpg: w/o user IDs: 1
gpg: secret keys read: 1

How did you exactly generate the key?

I generated the key by booting Tails (6.18) from a USB, the clock was not set right (UTC vs BST time) hence the above error about the key being created in the future - the key should import once the creation date is in the past (i.e. now). The gpg version used was: 2.2.40

[alansav]

I've downloaded the latest version of Tails (7.9.1) which has gpg version 2.4.7 on it. Will try generating certificate subkeys using this later and will post back here to update on if this has the same issue or not.

[alansav]

Downloaded the current version of Tails (7.9.1) which has gpg version 2.4.7 on it. Generated a master key (certify only) and then 3 subkeys. Exported the master key and the subkeys separately, imported the subkeys to Password Store app on the Android and still getting the error message: "No decryption keys found: Open the PGP key manager and import matching secret PGP keys from backups for key ID(s): ". It is like it is looking for the keys based on the fingerprint for the master key rather than the sub key.
Importing the same subkey on a laptop and an iPad (the Pass app) all work fine.

[agrahn]

I tried your key again. The app imports it and also entries created with it are decrypted now without the least problem.

[agrahn]

@alansav , what happens if you try my stripped key example above? Which APS version are you using?

[alansav]

@alansav , what happens if you try my stripped key example above? Which APS version are you using?

I am on version 1.16.3 (installed via F-Droid), I haven't had chance to try your key example yet, but will give it a try at some point this week and report back.

[alansav]

I have just tried the following:

1. "Settings/Repository/Delete repository"
2. "Settings/PGP settings/Key manager" and delete all keys
3. Created a local repository
4. Imported your stripped key example
5. Created a credential pair, saved it and then confirmed I could decrypt it

Repeated steps 1-5, except for step 4 where I imported my subkey - again this worked fine.

I then deleted the repository, and then cloned my main repository back, tried to decrypt it, but it failed with the same message. The fingerprint in the error message is the fingerprint for the master key, not the subkey.

I also did a compare between your stripped subkey and mine, and other than timestamps, only other difference I noticed was you don't have expiry dates set, but mine are all in the future (couple of years from now).

In addition the subkey is installed on my desktop and laptop (the master is not) and decryption works fine on that with pass

Hope this helps.

[agrahn]

The key ID shown in this dialog is the one found in the .gpg-id file in the passwords repo. It is usually the master (C) key ID, but it may also be one of the subkey IDs (this may happen if the store was initialised with pass on the desktop using a subkey ID); it only serves to identify the whole keyring. Would you please verify that this ID is among the ones shown in the "Change PGP passphrase" menu (via PGP key manager, three-dots-menu right of PGP key, then "all matching subkeys" drop-down)?

[alansav]

Thank you for coming back to me on this.

I have checked and the key ID shown in the dialog matches the one in the .gpg-id file and that is the master (c) key ID. In the Change PGP passphrase menu, selecting the all matching subkeys dropdown lists all keys (C, S, E and A). The fingerprint for each of the keys match those used on my desktop (well, the last 16 characters) for each respective subkey.