Load OpenPGP Protonmail Keys

SSH, OpenPGP, GPG
1

I have 3 Protonmail OpenPGP ECC (Curve25519) keys and one ecdsa-sha2-nistp256 SSH Key.

Each PGP key has a Primary key and one Subkey 1.

I had ECC1 loaded with Subkey 1 Decryption, ECC2 With Primary Key Signing, and ECC3 with ECDSA for both signing and decryption
When I tested it, WebCrypt worked for both encryption and decryption.

My issue is when I tried to do ECC4 for Subkey 1 and ECC5 for Primary key for the next PGP key, It encrypted the message in WebCrypt, however when trying to decrypt the message it showed
"Error: integrity check failure; got bad IV in decryption"

My Question is: How do I load all of my 3 PGP keys and ECDSA key in OnlyKey, as in which slot takes which option (I understand that autoload would fix this issue, but I want my ECCs labeled)

Thank you

1 Like
2

For WebCrypt you have to use your decryption key in slot 1 and your signing key in slot 2 (this is the default when following guide here Import keys from Keybase, Protonmail, and GPG | Docs).

My Question is: How do I load all of my 3 PGP keys and ECDSA key in OnlyKey, as in which slot takes which option (I understand that autoload would fix this issue, but I want my ECCs labeled)

You can only use on ECC PGP key with WebCrypt. You could use an additional RSA PGP key with WebCrypt.

3

@t11 So I can have only a single OpenPGP key and a single RSA key on my onlykey?

Then why are there 16 slots? What do I use the rest of the slots for?

4

So I can have only a single OpenPGP key and a single RSA key on my onlykey?
Then why are there 16 slots? What do I use the rest of the slots for?

No, you can use all of the OpenPGP keys locally - OnlyKey SSH/GPG agent | Docs
On the web you can only use a single OpenPGP ECC key and a single OpenPGP RSA key.

5

@t11 Ok so Here is what I understand, please confirm if I got everything correct:

I can use a single ECC key in webcrypt which is located in slots ECC1(Decrypt) & ECC2 (Sign)
I can also use an RSA Key with webcrypt in slot ECC3(Both Decrypt & Sign)

For Local usage, I can use the rest of the slots, which means in my case:
PGP key No 2 Will be: ECC 4 Decrypt, ECC 5 Sign
PGP Key No 3 Will be ECC 6 Decrypt, ECC 7 Sign

On a Separate Note:
How do I use the stored ECC key In my own OnlyKey Backup?
What is “Add private key” option in Advanced section of onlykey app used for if you can’t add the PGP key inside (Text size is short) ?

Sorry if I’m asking too many questions, just want to be sure 100%

6

I can use a single ECC key in webcrypt which is located in slots ECC1(Decrypt) & ECC2 (Sign)

Yes

I can also use an RSA Key with webcrypt in slot ECC3(Both Decrypt & Sign)

No, You can use an RSA key which is located in slots RSA1 (Decrypt) and RSA2 (Sign) in Webcrypt

How do I use the stored ECC key In my own OnlyKey Backup?

You check the check box here
image

What is “Add private key” option in Advanced section of onlykey app used for if you can’t add the PGP key inside (Text size is short)

This is to load a raw ECC private key (32 bytes), this allows loading any kind of key ECC even if its not OpenPGP compatible - Add support for GPG keys with multiple subkeys · Issue #166 · trustcrypto/OnlyKey-App · GitHub

7

What About

For Local usage, I can use the rest of the slots, which means in my case:
PGP key No 2 Will be: ECC 4 Decrypt, ECC 5 Sign
PGP Key No 3 Will be ECC 6 Decrypt, ECC 7 Sign

Is this correct?

8

Yes, this is correct

9

Awesome, thanks for taking the time to clear things up for me.