0

When should I backup my primary OpenPGP key?

I recently generated an OpenPGP key using the following setup (output of gpg2 --list-keys):

pub   rsa4096/KEYIDSC 2017-10-19 [SC]
uid         [ultimate] My Name <[email protected]>
sub   rsa4096/KEYIDE  2017-10-19 [E]
sub   rsa4096/KEYIDS  2017-10-19 [S]

And here is the output of gpg2 --list-secret-keys:

sec#  rsa4096/KEYIDSC 2017-10-19 [SC]
uid         [ultimate] My Name <[email protected]>
ssb   rsa4096/KEYIDE  2017-10-19 [E]
ssb   rsa4096/KEYIDS  2017-10-19 [S]

To sum it up, I store a backup of my primary key offline (sec#) and use the subkeys for signing and encrypting.

Now, suppose I want to add an user ID for (with adduid), I'll import my backup private key and edit it. My questions are now:

  1. Should I do a new backup of my private key using the export command?
  2. Do I need to edit the subkeys too? Or did they automatically take into account the addition of the new UID?
  3. Assuming the subkeys are modified during the process, should I export them to my other computers, or will the old ones continue to do the job?
  4. I currently didn't upload my key to a keyserver, should I do it? Would it automatically solve the bother of exporting the subkeys again as mentionned in the previous question (if such issues exist)?
  5. What other commands/actions, besides adduid, will require a new backup of my keys?

Please feel free to ask for precisions below, I'll try my best to answer them, but take into account I'm relatively new to OpenPGP.

1 Answer 1

1

Should I do a new backup of my private key using the export command?

If you upload your public key to the key server network, backing up all private keys (and this includes all subkeys you want to be able to restore) is enough -- everything else can simply be fetched from the key servers again. Any (even otherwise minimal) export of your private keys always includes the respective public keys.

If you don't upload it regularly, you have to distinguish between different kinds of things you might lose:

  • "lost" user IDs are not really an issue, you can just generate new ones (they'd have another timestamp and a newer signature, but this is not an issue in practice)
  • new public settings have to be setup again, obviously (those you can use to ask others what ciphers, compression algorithms etc. to use)
  • incoming certifications stored in your keyring are something not issued on your own, so you'd have to collect them again (but then, if you don't share them, they're not really of use anyway)
  • if you create new subkeys, these are obviously not contained in your backup/export yet and cannot be regenerated, so make a backup
  • revocation certificates might be reasonable to backup, but then again these are of no use if you don't share them anyway

Do I need to edit the subkeys too? Or did they automatically take into account the addition of the new UID?

No, there is no direct connection between subkeys and user IDs. Both are only coupled to the primary key.

What other commands/actions, besides adduid, will require a new backup of my keys?

Backup is not really an OpenPGP-specific matter, considering your keyrings is not different to anything else you store on your computer.

Pragmatic point of view: you're changing stuff on your computer all the time, and if you care about your files you require something like a current, automated and regularly scheduled backup anyway. This will include just any change to your GnuPG keyring (no matter whether an important change or not), even considering whether to backup some small files or not is not worth the effort -- storage is cheap, in doubt backup everything.

Less generic answer: backup everything you don't want to lose. If it's just your keys, generate a new backup after each change of those. If you care about anything else, run a backup after this is stored.

1
  • Thanks very much for your detailed answer, you made me realize I was doing some of the backups wrong.
    – user775750
    Oct 27, 2017 at 17:03

You must log in to answer this question.