2

I have two keys for my principal user ID: an old one, and a longer one I generated more recently. I no longer use the old one. I set the default key to the newer one using the default-key option in ~/.gnupg/gpg.conf.

However, some tools override the default setting, for example calling git tag -s, which calls gpg -bsau DEFAULT_COMMITTER_EMAIL_ADDRESS under the hood. (This is sensible, because my default committer email address may not match my principal user ID for gpg.) This seems to make GnuPG use the first key it finds that matches the user id, typically the oldest.

I can fix this in my git configuration by setting a default key there too, but I'd rather not have this duplicate setting (because in my case, all the identities are the same).

I managed to work around it by removing the older keys from my keyring, then re-adding them (which seems to add them at the end). Then, my newest (preferred, default) key comes out first in gpg --list-secret-keys, and hence it is the first match returned for my user ID.

Is there any way to avoid this workaround (which I'd have to redo each time I generate a new key)?

1 Answer 1

0

There is no such configuration option for GnuPG. Defining a distinct key (by fingerprint, or at least long key ID due to collision attacks) to use is a reasonable thing to do anyway: malicious users might well send you private keys for your user IDs that you gpg --import expecting some public key and get picked up unnoticed.

Then, dealing with a larger number of primary OpenPGP keys for the same user ID and exchanging them regularly might not be best practice, either (consider the discussion in "How many OpenPGP keys should I make?"). Not only does it confuse others ("Which of those keys to use?"), but it also breaks with any certifications and your integration in the OpenPGP web of trust each time you roll your primary key. Consider whether sticking with a single (high-security, maybe even stored offline) and rolling subkeys can be adapted to your use case -- this resembles what might be called best practice in OpenPGP key setups (although there is room for discussion and variations, of course).

3
  • Thanks for your answer, but unfortunately I don't understand it. First, I already have distinct keys for the user ID in question; why does this preclude being able to specify which one is listed first? Secondly, I am not using more than one key regularly. I created a new one longer than my old one, but my old one is still listed first, and hence picked up by git as the default one to use. Oct 7, 2017 at 11:26
  • I've tried to clarify the question. Oct 7, 2017 at 11:33
  • The essence on my answer wouldn't change: there is no way in GnuPG to define a preference which key to use for which user ID, and the recommendation of pinning a key by defining a fingerprint still stays the same: you can either choose a user ID or a key by ID, but not a combination of both. The only alternative would be to provide a second GnuPG home directory with only the specific key, and start separate instances of gpg-agent, so you can choose the key by excluding all others and then select the user ID through the --local-user option.
    – Jens Erat
    Oct 7, 2017 at 19:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .