GPG Key Management Basics | Generated by AI

Home 2025.10

Introduction to GPG Key Management

GPG (GNU Privacy Guard) is a free implementation of the OpenPGP standard for secure communication, used for encrypting, signing, and verifying data. At its core is public-key cryptography, where each user has a public key (shared openly for encryption and verification) and a private key (kept secret for decryption and signing). Key management involves creating, distributing, maintaining, and securing these keys to prevent tampering, compromise, or misuse. Poor management can lead to attacks like key substitution, where an attacker replaces your key with theirs to intercept communications.

The “web of trust” model in GPG allows users to certify each other’s keys, building a network of verified identities. Keys are stored in keyrings (public and private files, e.g., pubring.kbx and secring.gpg in older versions, or unified in newer ones). Always back up your private keys and use strong passphrases.

Key Structure

A GPG keypair isn’t just one key—it’s a bundle:

View a key’s structure interactively:

gpg --edit-key <key-id-or-email>

Inside the menu, use check to verify self-signatures or toggle to see private parts (if available).

Generating Keys

Start with a primary keypair. Use the interactive method for beginners:

  1. Run gpg --full-gen-key (or --gen-key for defaults).
  2. Choose key type (default: RSA for both signing and encryption).
  3. Select key size (e.g., 4096 bits for stronger security; minimum 2048 recommended).
  4. Set expiration (e.g., 1y for one year; “0” for never—avoid indefinite if possible).
  5. Enter user ID (name, email).
  6. Set a strong passphrase (20+ characters, mixed case/symbols).

For quick generation (non-interactive):

gpg --quick-generate-key "Alice <alice@example.com>" rsa default 1y

After generation, create a revocation certificate (a file to invalidate your key if compromised):

gpg --output revoke.asc --gen-revoke <your-key-id>

Store this safely (e.g., printed in a vault)—don’t share it until needed.

To add subkeys or UIDs later:

Listing and Viewing Keys

Output shows key ID (short/long), creation/expiration dates, capabilities (e.g., [SC] for sign/certify), and UIDs.

Exporting and Importing Keys

Exporting shares your public key or backs up private ones:

Importing adds others’ keys to your public keyring:

After importing, verify with gpg --edit-key <key-id> and check for self-signatures.

Signing and Certifying Keys

To build trust:

This creates signatures on the key, visible in listings. The web of trust calculates validity based on your trust in signers.

Revoking Keys

Revocation invalidates a key or component without deleting it, ensuring others see it’s no longer valid:

Reasons for revocation: compromised, no longer used, superseded. Always publish revoked keys.

Best Practices

For hands-on, experiment in a test directory with gpg --homedir ./test-gpg.

GnuPG Handbook: Key Management
GNU Privacy Guard Manual: OpenPGP Key Management
GnuPG Getting Started

Back

openai/gpt-5

Donate