GPG Key Management

August 03, 2014

GPG2 is a brilliant encryption tool, but so rarely used.

It's not used mostly because it's difficult to get buy-in from all the people with whom you want to securely communicate.

But if you use it and are lucky enough to find peers who use it as well, it's a great boon for secure private communication and data storage.

Keep Your Master Key Safe

This is a key management technique I learned while working at UC Berkeley: Keep your master signing key away from your working keyring and use it only when you need it.

Operations that use your master key include: Signing someone else's key, adding subkeys, and performing revocations. Guard your master key!

Here's how:

If you only generated default keys, you must create a new signing subkey:

gpg --edit-key YOURMASTERKEYID

Choose the "RSA (sign only)" key type, choose 4096 bits, no expiry. When it's done, save the key:


Backup your keyring to an off-system location, like an encrypted USB drive.

Seriously, back them up, you will delete your masterkey in the steps below so don't cry if you fail to backup your keyring and hastily execute the commands below, losing your key-pair.

cp -R ~/.gnupg /Volumes/usbmedia/gnupg

Now do the following:

gpg --list-secret-keys
gpg --export-secret-subkeys SUBKEYID1! SUBKEYID2! > subkeys
# (NOTE: The exclamation marks ! are significant)
gpg --export YOURMASTERKEYID > pubkeys

At this point you have backups of your secret subkeys, and public key.

Remove your master key:

gpg --delete-secret-key YOURKEYID
gpg --import pubkeys subkeys

Now you have a key pair you can use on multiple computers. If you later need to do an action that requires signing with your master key (e.g. signing an imported pubkey for trust), do:

gpg --home=/path/to/backup --sign-key IMPORTEDPUBKEYFILE

All other actions like signing messages and encrypting can use your masterkeyless default keyring.

How This Helps

Your secret subkeys are always linked to your master key. If security of your master key is compromised, you not only lose the web of trust you've built with others, but it also reduces the reputation of anyone who has already signed your key. By separating your master key from signing and encryption subkeys, you can have more control over your key pair by keeping the master key offline.

Granted, if someone steals your working keyring, it does not stop that person from decrypting your past messages or impersonating your signature associated with those subkeys. However, a secure offline master key allows you to revoke compromised or stolen subkeys while retaining your web of trust.