# Wiping and setting PGP keys **URL:** \ **Category:** SSH, OpenPGP, GPG\ **Created:** [March 15, 2023, 5:02pm UTC](https://onlykey.discourse.group/t/wiping-and-setting-pgp-keys/1034 "2023-03-15T17:02:53Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![MLS69](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@MLS69](https://onlykey.discourse.group/u/MLS69)\ **Post date:** [March 15, 2023, 5:02pm UTC](https://onlykey.discourse.group/t/wiping-and-setting-pgp-keys/1034/1 "2023-03-15T17:02:54Z")
Hello. I’m trying to use OK with Pass password manager. Added export GNUPGHOME=~/.gnupg/onlykey to my profile, initialized everything etc… I loaded ECC PGP keys as described and everything seemed to be working well- I’m able to use Pass with OnlyKey #1, #2. However with OKs #3 and #4 they do not work- they seem to have a different ECC key? despite loading the SAME key into all of my OnlyKeys. So to trouble shoot, I (tried) wiping all keys in all 16 slots for all OKs using both the app and ClI- got confirmation. OnlyKey\> getkeylabels Slot RSA Key 1: Slot RSA Key 2: Slot RSA Key 3: Slot RSA Key 4: Slot ECC Key 1: Slot ECC Key 2: Slot ECC Key 3: Slot ECC Key 4: Slot ECC Key 5: Slot ECC Key 6: Slot ECC Key 7: Slot ECC Key 8: Slot ECC Key 9: Slot ECC Key 10: Slot ECC Key 11: Slot ECC Key 12: Slot ECC Key 13: Slot ECC Key 14: Slot ECC Key 15: Slot ECC Key 16: I removed the previous onlykey folder in the .gnupg folder. As a test, I re-initialized my OnlyKeys #1-2 thinking I should get an error since there should be no keys, _but still I see those same ECC key ring in the .gnupg folder- those keys again are identical to the ones prior to wiping._ I repeated this with Only Keys (#3, #4) and again I see the same ECC key ring for those particular OKs prior to wiping. Interestingly, when I initialize the Onlykeys, the same challenge code is present for OKs 1-2; another different challenge code for OKs 3-4- the code is the same for OK 3 and 4 but different from OK 1 and 2. (OK 1, 2 are identical- restored from same backup; OK 3,4 are totally different) I tried loading same RSA keys into all 4 OKs but still I see those previous ECC keyring in the .gnupg folder. After loading RSA keys, I do get a message each time saying “successfully loaded RSA keys”- both for signing and decryption slots 1 and 2. When I ask for “getkeylabels”, I see the same response as above- no labels for any slots. Not sure what I’m doing incorrectly. OSX Ventura 13.2.1 OK App v5.3.6 OnlyKey v3.0.4 GPG Suite 2023.1 ---
**Author:** ![MLS69](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@MLS69](https://onlykey.discourse.group/u/MLS69)\ **Post date:** [March 16, 2023, 10:14pm UTC](https://onlykey.discourse.group/t/wiping-and-setting-pgp-keys/1034/2 "2023-03-16T22:14:11Z")
Hello again. Apologies for responding before the reply but I believe I may have discovered the issue here. When I initialized the OK I used the command for _derived_ keys, rather than stored keys. Since they’re derived and can’t be exported, users will need a way to back up the keys. So the derived keys must be the same for OKs with the same backup phrase? (Is there a way to view stored or derived keys using Onlykey-CLI?) However, when I use the command for initialization for stored keys (i.e, onlykey-gpg init “XXXXX [XYZ@gmail.com](mailto:XYZ@gmail.com)” -sk RSA2 -dk RSA1 -i publickey.XYZ@gmail.com.asc) I keep getting the same error messages: gpg: inserting ownertrust of 6 gpg: checking the trustdb gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: next trustdb check due at 2036-03-11 gpg: keydb\_search failed: End of file gpg: error reading key: End of file Traceback (most recent call last): File “/Users/XXXXX/Library/Python/3.11/bin/onlykey-gpg”, line 33, in sys.exit(load\_entry\_point(‘onlykey-agent==1.1.14’, ‘console\_scripts’, ‘onlykey-gpg’)()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File “/Users/XXXXX/Library/Python/3.11/bin/onlykey\_agent.py”, line 6, in gpg\_tool = lambda: libagent.gpg.main(DeviceType) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File “/Users/XXXXX/Library/Python/3.11/lib/python/site-packages/libagent/gpg/ **init**.py”, line 392, in main return args.func(device\_type=device\_type, args=args) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File “/Users/XXXXX/Library/Python/3.11/lib/python/site-packages/libagent/gpg/ **init**.py”, line 226, in run\_init check\_call(keyring.gpg\_command([‘–homedir’, homedir, File “/Users/XXXXX/Library/Python/3.11/lib/python/site-packages/libagent/gpg/ **init**.py”, line 114, in check\_call subprocess.check\_call(args=args, stdin=stdin, env=env) File “/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/subprocess.py”, line 413, in check\_call raise CalledProcessError(retcode, cmd) subprocess.CalledProcessError: Command ‘[’/usr/local/MacGPG2/bin/gpg’, ‘–homedir’, ‘/Users/XXXXX/.gnupg/onlykey’, ‘–list-secret-keys’, ‘XXXXX [XYZ@gmail.com](mailto:XYZ@gmail.com)’]’ returned non-zero exit status 2.