Load backup key on new Nitrokey Pro

Nitrokeys
1

Hello,

my Nitrokey Pro was replaced because of a defect. Now I try to move my existing key to it in linux mint but I fail :see_no_evil:

I created the key directly on the old Nitrokey and made a backup. Could someone please give me a hint how to load the privkey_NAME.asc to the new stick? I tried it with
gpg --card-edit NAME
bkuptocard PATH_TO_ASC
but I get “invalid command”

Thanks for your help!

2

dd4711, have a look at this discussion, but I fear if you created the original key straight on the former key, you have no backup…
I myself didn’t try this while clearly it’s a key issue for me, but I understand that if one wants a backup, the key must be created outside of the Nitrokey then uploaded in the NK (and saved elsewhere for backup).
Maybe others more knowledgeable than I am will correct me…

1 Like
3

Hi @dd4711,

As @Herve5 pointed out, keys generated on-device are never backed up except for the encryption key (as opposed to misleading message from the GnuPG). In that case the key private data is lost unfortunately, sorry. The only way to have backup for a key is to generate it on PC securely, and then transfer to the device. The guide for importing the key existing on the PC is here:

5

Hello @Herve5 , @szszszsz ,

Thanks first for your answers! Maybe my inital post is not correct.

I followed exactly the key creation as described at that documentation you linked.
I also made a backup of my keys, too:

gpg --armor --output privkey_jane@example.com.asc --export-secret-keys jane@example.com
gpg --armor --output pubkey_jane@example.com.asc --export jane@example.com
gpg --export-ownertrust > jane@example.com.txt

From that backup I have my sec Key, my pub key and additionally my revoke key. Everything I need to reload it to my new Nitrokey!? As I understand that I have to begin with step “Key Import” of that documentation?!

6

That is correct.
And you may need to delete the old key stub in your keyring (make sure to still have the backup of the original backup key :wink:), because it is referencing your keys to the old Nitrokey. Then you import the pubkey, hit gpg --card-status and everything should be fine again.