3

I store my PGP private key offline in a few different locations, in case of disk failure. However, in order to sign someone else's key, I must first import my private key back into my keyring. But this gives me a few questions, which I was unable to find answers to online.

1) Does signing their key modify my private key? Is it necessary to re-backup my private key after signing? (I would test this myself, but the output of gpg --export-secret-keys -a seems to change every time regardless of modifications, so it's hard to be sure).

2) After signing a public key, you must send the owner back their key so they can share the new signature (possibly to a keyserver). But, the RFC specification on the private key packet format states that it contains all fields of the public key. Does this mean that when someone signs my public key, I need to update my private key backups to reflect this change?

3) What other situations require me to update my private key backups?

2

"Does signing their key modify my private key?":

No, signing a key only changes the key of the other person and not your own key.

"Does this mean that when someone signs my public key, I need to update my private key backups to reflect this change?":

A private key stores a full copy of the public key but that copy only gets used in case you import the private key without already having a corresponding public key.A key signature will be added to the public key and the public key will be added to the private key.So you either need to update and back up your private key or you need to make extra copies of your public key, which usually is the preferred option because a public key backup doesn't need to be protected like a private key backup.

"What other situations require me to update my private key backups?":

In case you only store a backup of the private key:

  • Adding/Deleting UID
  • Adding/Deleting photo ID
  • Getting the key signed/Removing the signature
  • Creating/Removing a revocation certificate
  • Adding/Removing a subkey
  • Changing expiration date
  • Changing private key password
  • Changing allowed usage
  • Changing preferences of key

In case you store a recent backup of your public key:

  • Adding a subkey's secret key
  • Changing private key password

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.