I'm playing around with GPG (v2.2.8), trying to get a primary/master key with subkeys and several uids attached. To get to the point I'm at, I:

  1. Created the master key and gave it only (C)ertify ability.
  2. Created 3 subkeys, each with only one of (E)ncrypt, (S)ign, (A)uthenticate ability.
  3. Created revocations and paperkeys for them.
  4. Exported .gnupg folder off the machine.
  5. Removed the master private key.

As I did this quite a few times having made mistakes and misunderstanding the process (you've used gpg, right?;) I started to become more confident and in my new found state added a uid I shouldn't have. So I did the following:

gpg --edit-key 0xXXX

gpg> 2
gpg> deluid
Really remove this user ID? (y/N) y
gpg> save

What puzzles me is that there was no prompt or warning about the primary key - does it not have the uid too? Are they only tied to the public key so the private part doesn't care? Should I reimport it and remove the uid and then export it?

These are the questions this episode has prompted.

I haven't shared the keys and I'm playing around so I can blitz the whole lot if need be, just trying to understand how gpg works. Then I'm going to move on to creating a super secure crypto algo because that's probably easier to manage!


It's a one-way relationship: the primary key can have UIDs attached to it, and attaching an UID requires signing it with the primary key (self-certifying), but the primary key does not depend on UIDs' existence, and adding/removing UIDs does not alter the primary key itself in any way. The UIDs are standalone packets, and are only necessary for key lookup by name/address (instead of by fingerprint).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.