Home / ubuntu / Questions / 288853
Accepted
fouric
Asked: 2013-05-01 18:43:18 +0800 CST

Why is gpg getting upset and how do I stop it?

  • 772

I recently migrated from one installation of Ubuntu to another, and in the process changed my username. I imported my public/private key pair into gpg, and while decryption (using my private key) works fine, whenever I attempt to encrypt something to myself with my public key I get the following warning message:

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

After that it asks me whether I really want to use the key (I always answer "yes", because it is in fact the only key in my keyring and I know where it came from). I can decrypt stuff just fine, so why does gpg throw a hissy fit whenever I try to encrypt something? And how can I prevent this message from appearing again?

gnupg

3 Answers

  1. I ran into the same issue however I no longer had access to the old key. So you can recreate the trust on your old key with this:

    gpg --edit-key [email protected]
gpg> trust
Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y
    • 36
  2. Best Answer

    I managed to reproduce the problem which you are experiencing. I did so doing the following:

    $ gpg --no-default-keyring --keyring ./test-keyring  --secret-keyring ./test-secring --trustdb-name ./test-trustdb --no-random-seed-file --gen-key

<specified parameters and let it do its thing>

gpg: key 58018BFE marked as ultimately trusted
public and secret key created and signed.

<snip>

$

    Notice that the process marked the key as "ultimately trusted".

    Now I export the keys:

    $gpg --no-default-keyring --keyring ./test-keyring  --secret-keyring ./test-secring --trustdb-name ./test-trustdb --no-random-seed-file --export-secret-keys -a >private.key

$gpg --no-default-keyring --keyring ./test-keyring  --secret-keyring ./test-secring --trustdb-name ./test-trustdb --no-random-seed-file --export -a > public.key

    Now I import to a new gpg database:

    $gpg --no-default-keyring --keyring ./test2-keyring  --secret-keyring ./test2-secring --trustdb-name ./test2-trustdb --no-random-seed-file --import public.key

$gpg --no-default-keyring --keyring ./test2-keyring  --secret-keyring ./test2-secring --trustdb-name ./test2-trustdb --no-random-seed-file --import private.key

    Now if I attempt to encrypt using the new keyrings I get:

    $ gpg --no-default-keyring --keyring ./test2-keyring  --secret-keyring ./test2-secring --trustdb-name ./test2-trustdb --no-random-seed-file -r Fake -e
gpg: AE3034E1: There is no assurance this key belongs to the named user

pub  1024R/AE3034E1 2013-06-13 Fake User <[email protected]>
 Primary key fingerprint: AD4D BAFB 3960 6F9D 47C1  23BE B2E1 67A6 5801 8BFE
      Subkey fingerprint: 58F2 3669 B8BD 1DFC 8B12  096F 5D19 AB91 AE30 34E1

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

    The reason for this is the "web of trust" model. By default, in order for a public key to be trusted, it requires either 1 "ultimate" trust certificate (typically where you personally have verified the identities of the people involved), or 3 "marginal" trust certificates (where somebody you know, who knows somebody you know ... has signed the certificate).

    Because gpg is a security application, it warns you if you are attempting to encrypt to a key which is not listed as trusted. The reason your own key isn't trusted in this case is simple. It is because you did not export the trust relationships from the previous gpg instance. To do this, use the --export-ownertrust and --import-ownertrust commands.

    As always, refer to the man page.

    • 18

  3. You can use the --always-trust flag to skip this message.

    • 9