What's the best way of keeping a PGP private key file generated by GnuPG?

Question

What's the best way of keeping a PGP private key file generated by GnuPG?

I will just store my public key online, in Gmail, on many of my computers. Where/how best to protect and store the private key file?

Answer 1

Use your favorite encryption software, or just leave it alone on your desktop somewhere or anywhere you want on your computer (assuming physical access to your computer is secured, there is little/no chance that someone will be able to get the key).

Answer 2

TL;DR a flash drive or a CD in a safe place.

Seeing as this is a security question, I would be very hesitant to entrust my private key to Google or any other major cloud service. Call me paranoid, but your PGP key is your signature. I hate to remind you of the simple, but with your PGP key I "am" you. Personally, I would back up my key across any/all computers I own and for good measure put a labeled CD or flash drive somewhere safe. (like a gun safe)

edit: oops, sorry @soandos had the same idea first.

Answer 3

I would store it in an encrypted format somewhere else. Options include on a truecrypt volume, in a keepass database, or what ever other form of encryption you prefer. Depending on how nervice you are about security will determine weather you would store the key in the cloud, but if I used strong encryption to encrypt the private key and was not protecting extremely sensitive data I would probably store it in gmail or dropbox.

Answer 4

If you go for storing your private keys online to some untrusted location, encrypt the keys themselves, also consider an additional level of protection like steganography (hide the keys in some media files like images).