0

I have exported my key with

gpg --export-secret-key "user name" > path/to/secretkeybackupfile.key

and then done

gpg path/to/secretkeybackupfile.key

It displays the details of the key as being a secret key with the correct ID. Is there a way to test that it will actually decrypt a file I have made with that key and therefore prove that it really is the correct key and working correctly?

The only way I can see of doing this is deleting the original key and then importing the copy of it back into the GPG keyring...

Also, I notice that when exporting the key it will overwrite the file specified without any warning, and that only including part of the username appears to have the same effect as including the whole user name, is this correct and is it the desired behaviour?

0

It displays the details of the key as being a secret key with the correct ID. Is there a way to test that it will actually decrypt a file I have made with that key and therefore prove that it really is the correct key and working correctly?

Set $GNUPGHOME to a temporary empty directory, then you'll be able import your key into a new blank keyring. After testing, unset the variable (or close the shell window) and you're back to your regular keyring.

mkdir -m 0700 ~/gnupgtest
export GNUPGHOME=~/gnupgtest
gpg --import ~/backup.gpg
gpg --list-secret-keys

Also, I notice that when exporting the key it will overwrite the file specified without any warning

The > shell operator will always overwrite the file without warning. Redirection operators are not part of gpg – they are a part of your shell's language/syntax and they behave identically no matter what command you use them with.

In bash, you can use set -o noclobber to make > avoid overwriting files; you'll then have to specify >| (bash) or >! (zsh) whenever you actually want the overwrite to happen.

and that only including part of the username appears to have the same effect as including the whole user name,

That's intended behaviour; key selection works the same with --export as it does with --list-keys, --recipient, and other similar options. You have always been able to gpg -k fred to list all matching keys.

More importantly, you have always been able to create any number of keys with identical names and addresses. (For example, I have 4–5 secret keys, and of course all have the same name on them, differing only in email addresses. My public keyring, too, shows several people having had multiple keys over time.)

The only always reliable way to select a single key is by using its full fingerprint. The other usually reliable way is to use the 16-digit "key ID" (which is the truncated fingerprint).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.