I want to create keys that I can use to sign & encrypt files, and share the decryption keys so people can read the encrypted files and see my signature.

I've successfully created an encryption/signing key in Alice device, and I'm able to encrypt messages and files with it that I can decrypt in Alice device.

However when I try to share the keys I get an .asc file that when imported on Bob's device, has a orange ? icon, and when try to decrypt the encrypted file, I get "No encrypted data with known secret key found in stream!"

Any idea what I might be doing wrong?

importing .asc key key has no valid signature imported key has no decryption powers
Screenshots (click images for larger variants)


2 Answers 2


With OpenKeyChain as with any PGP app, you always generate key pairs: one private and one public key. The private key can be used to decrypt data which was encrypted with its public counter-part.

Now, when you share a key, you always share the public part – which can be used for encryption, but not for decryption. Hence, the message encrypted using Bob's key cannot be decrypted with Alice's key: on that device, only Alice's key pair and Bob's public key are present, so only Alice's private key is tried for decryption. Hence you get that error message.

  • my use case of document signing is the reverse scenario; the encryption key should be private, the decryption key public. How do I do it?
    – lurscher
    Apr 5, 2017 at 6:38
  • If Bob wants to send an encrypted document to Alice, he should use Alice's public key to encrypt it. Then Alice can decrypt it using her private key. That's how PGP works. If you want multiple people to be able to decrypt, use all their public keys for encryption.
    – Izzy
    Apr 5, 2017 at 9:55
  • that is not how document signing is supposed to work. Document should be public and anyone with my public key should be able to confirm that it indeed comes from me, because only me own the (private) key needed to encrypt/sign it
    – lurscher
    Apr 5, 2017 at 11:05
  • No, that's not how signing works. You've asked about encryption, not signing – and I've explained you how to do that with OpenKeyChain. If you have general problems understanding cryptography and its terms, this is the wrong site to ask.
    – Izzy
    Apr 5, 2017 at 11:24

See RSA Cryptography on Wikipedia.
You can simply share the encryption key and force decrypt unencrypted data with your decryption key. This works exactly the same as Digital Signature - anyone can verify but only you can sign.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .