0

As the title reads, I wonder how I could securely, physically remove my private keys from my computer. I can't seem to find a way to do that on Kleopatra. These keys I'm talking about are used for high security operations only. So I'd rather have my private keys stored only on my trusted usb, nowhere else. If the computer I had the keys on was compromised, then my passphrase would be my only line of defense left. Therefore, it would be convenient if I could securely delete the private keys stored on my computer and have them read from my usb when I need them. Any suggestions on how to do this?

3 Answers 3

1

You cannot really only move the private keys, it would be easier moving the whole GnuPG home directory, which is usually the hidden folder ~/.gnupg (in Windows, somewhere deep in the hidden AppData folder).

If you move this folder to the USB drive, either use the GnuPG option --homedir to make GnuPG use the directory on the USB drive, or set the environment variable GNUPGHOME.

Consider using OpenPGP smart cards, though: using those, the private key stays on the smartcard and can never be exported to your computer. Thus, even when using on a compromised computer, a possible attacker would lose access again after the card was removed. There are also solutions connected through USB like the YubiKey or Nitrokey.

1

I used to delete whole directory in user home with secure-delete ( on Ubuntu apt-get update && apt-get install secure-delete ). Command is test -d ~/.gnupg && srm -r ~/.gnupg.

For better entropy install apt-get update && apt-get install haveged, create config file echo -e "# Configuration file for haveged\nDAEMON_ARGS=\"-w 1024\"" | tee /etc/default/haveged and restart service test -f /etc/init.d/haveged && /etc/init.d/haveged restart.

You must install secure-delete and haveged as root. Command srm may run as any user with shell. These commands I used in Ubuntu Xenial ( 16.04 LTS ).

0

Copy your .gnupg directory to your USB drive.

Then use a secure wipe program to wipe out the old .gnupg directory; which program to use depends on your OS. Don't rely just on deleting the file as this leaves intact most of the data.

Then run GPG using the command-line option --homedir <newdir>, where newdir is the GPG directory on your USB disk.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .