GPG Keychain: PGP key import does not import "Comment:" component, and we can't edit the comment after it is loaded.

David Edson's Avatar

David Edson

17 Dec, 2018 11:22 PM

Which of our tools is giving you problems? GPG Tools KeyRing editor
MAC Version 1.4.6 (1514)

Attach a screenshot of the version info for all installed components (how to: https://gpgtools.tenderapp.com/kb/faq/where-can-i-find-version-info...):

Describe your problem. Add as much detail as possible. PGP key import does not import "Comment:" component, and we can't edit the comment after it is loaded.

What did you expect instead The comment to be imported, or the ability to edit the comment after it is loaded.

Describe steps leading to the problem. import the key

Are you using any other Mail.app plugins? no

  1. Support Staff 1 Posted by Steve on 17 Dec, 2018 11:26 PM

    Steve's Avatar

    Hi David,

    welcome to the GPGTools support platform. Sorry you are having problems using GPG Suite.

    This is expected behavior. The key you are trying to import likely does not make use of the comment field. It's not a default and actually not recommended to use the comment field during key creation. The comment you are seeing in the textform of the OpenPGP key (before importing it) likely comes from the software used to export or create the key but is unrelated to comment field in the key itself.

    GPG Suite was also using the comment field a long time ago, but we opted to not use it anymore, since it increases the attack surface. It allows third parties to know which softawre is being used and in your example even which version of that software. Depending on your threat level, that could be relevant information for an attacker.

    Let me know if this makes sense.

    All the best,
    Steve

  2. 2 Posted by David Edson on 17 Dec, 2018 11:42 PM

    David Edson's Avatar

    ok, so how do I change the comment, It would be nice to have a way of adding notes to a key to help me remember the purpose, I have quite a few keys using the same email address.

    The key I loaded had this as the header, so I presumed the "comment:" would be loaded.

    -----BEGIN PGP PRIVATE KEY BLOCK-----
    Version: OpenPGP.js v2.6.2
    Comment: https://openpgpjs.org
    
    xcBmB...
    
  3. Support Staff 3 Posted by Steve on 18 Dec, 2018 10:25 PM

    Steve's Avatar

    The header of the key you are importing is created by the software that the key was generated / exported with.

    If you want to change that header that would have to be done in the software that exported the key. Or you can just remove the version and comment info from the text file holding the key. Make sure to create a backup of the file before changing anything.

    That command is not related in any way to the commend field, which you see in GPG Keychain when double clicking on a key from your key list.

    As the comment field is visible to anybody using the key, it is to be used with great caution.

    We have a ticket to allow some sort of adding a note for a key to allow users better key management. I connected this discussion with the existing ticket. That means, should this discussion get closed, it will be re-opened as soon as the ticket is closed. That way you'll stay in the loop and get notified as soon as we have news. Feel free to open a new discussions should you run into further problems or need assistance.

    You mention, you do have several keys for the same email address. Are you referring to public keys or sec / pub keys of your own?

    In most cases, having one key should be sufficient. But there can be situations where old unused keys still float around without the ability to revoke them. In that case you can select the key you do not want to use in GPG Keychain, double click it and tick the option to "Disable" that key at the very bottom.

    Best,
    Steve

Reply to this discussion

Internal reply

Formatting help / Preview (switch to plain text) No formatting (switch to Markdown)

Attaching KB article:

»

Already uploaded files

  • gpg-tools-key-import-without-comment.png 128 KB

Attached Files

You can attach files up to 10MB

If you don't have an account yet, we need to confirm you're human and not a machine trying to post spam.

Keyboard shortcuts

Generic

? Show this help
ESC Blurs the current field

Comment Form

r Focus the comment reply box
^ + ↩ Submit the comment

You can use Command ⌘ instead of Control ^ on Mac