GnuPG 2.4.4 / 2.4.5 のリリース【セキュリティ・アップデートを含む】

The standard way to generate keys on a smartcard with GnuPG is to create the encryption subkey with gpg and to move this key to the smartcard. A password protected backup file named sk_<keyid>.gpg is also created so that in the case of a lost or broken smartcard, the key can be restored to a new smartcard to allow decryption of existing data. Unfortunately with some versions of GnuPG an additional unprotected copy of the encryption subkey is also kept on disk.

All possibly affected users should check whether such an unintended copy of a smartcard key exists and delete it.

• Gpg4win version 4.2.0
• GnuPG versions 2.4.2 and 2.4.3 iff the card generation was done with the command gpg --card-edit.
• GnuPG version 2.2.42 iff the card generation was done with the command gpg --card-edit.
• GnuPG VS-Desktop version 3.2.0 and 3.2.1 iff the card generation was done with the non-approved command gpg --card-edit. The documented way to create keys on OpenPGP cards and Yubikeys is not affected.