Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What's the best way of keeping a PGP private key file generated by GnuPG?

I will just store my public key online, in Gmail, on many of my computers. Where/how best to protect and store the private key file?

share|improve this question

5 Answers 5

up vote 3 down vote accepted

Use your favorite encryption software, or just leave it alone on your desktop somewhere or anywhere you want on your computer (assuming physical access to your computer is secured, there is little/no chance that someone will be able to get the key).

share|improve this answer
    
My question was actually how do I keep my private key safe, from natural disaster, hardware failure, data theft etc., so I can keep the key pair safe and useful, and be able to restore the key elsewhere. So I can't really assume my computer is physically safe. –  Computist Jun 6 '11 at 1:41
    
Sorry, I didn't see that. The way to do it is either send it to yourself in an e-mail (encrypted preferably) or put it on a CD/USB/Floppy somewhere. –  soandos Jun 6 '11 at 1:44

TL;DR a flash drive or a CD in a safe place.

Seeing as this is a security question, I would be very hesitant to entrust my private key to Google or any other major cloud service. Call me paranoid, but your PGP key is your signature. I hate to remind you of the simple, but with your PGP key I "am" you. Personally, I would back up my key across any/all computers I own and for good measure put a labeled CD or flash drive somewhere safe. (like a gun safe)

edit: oops, sorry @soandos had the same idea first.

share|improve this answer

If you go for storing your private keys online to some untrusted location, encrypt the keys themselves, also consider an additional level of protection like steganography (hide the keys in some media files like images).

share|improve this answer

I would store it in an encrypted format somewhere else. Options include on a truecrypt volume, in a keepass database, or what ever other form of encryption you prefer. Depending on how nervous you are about security will determine whether you would store the key in the cloud, but if I used strong encryption to encrypt the private key and was not protecting extremely sensitive data I would probably store it in gmail or dropbox.

share|improve this answer

I found paperkey. Your private key also contains a copy of the public key. Since the public key is backed up to dozens of key servers you only need to worry about the private key without the included public key. Paperkey extracts only this essential information and gives you a plain text hexdump with checksums.

In case of an emergency, when everything else fails you can still manually (or with scanner and OCR) type in the hex dump and recreate your private key.

In addition to that there is optar. Optar is not related to cryptography. It just takes any file and gives you a QR-code like very dense encoding of these bytes. You might also feed the output of paperkey through optar to save you from manually typing when recovering your key. But make sure to also print the plain paperkey output since you're doomed if you've only the optar output but not the optar software anymore.

Paperkey is available in Debian, optar not yet.

In addition to those paper based backups you should take an USB stick with your private key and the scans of the most important documents (birth certificate, insurances, work references, certificates) and deposit it at a fire, robbery and law enforcement save place. (I personally would not trust banks with that.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.