I am trying to educate myself on the use of encryption keys and I've been experimenting with this old Linus Torvalds’ key that I found 956EB7BF449FA3AB.

I am interested to display the usage flags but neither gpg2 --list-keys 449FA3AB nor gpg2 --fingerprint 449FA3AB display the usage flags.

The only way I've found to get the usage flag information is this hackish way.

$ gpg2 --edit-key 449FA3AB
gpg (GnuPG) 2.0.26; Copyright (C) 2013 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

pub  1024D/449FA3AB  created: 1999-10-05  expired: 2001-10-04  usage: SCA 
                     trust: unknown       validity: expired
sub  2048g/BFF491C5  created: 1999-10-05  expired: 2001-10-04  usage: E   
[ expired] (1). Linus Torvalds <torvalds@transmeta.com>

gpg> quit


What is the official way to display the usage flags?

migrated from security.stackexchange.com Oct 30 '14 at 16:46

This question came from our site for information security professionals.


The machine-readable format using --with-colons contains the usage flag as last column. It is not very readable for humans, but contains the data you're looking for.

$ gpg2 --with-colons --list-keys 449FA3AB
uid:e::::939086351::81A3799583B9B1B391E4C428112F302FF2ADF462::Linus Torvalds <torvalds@transmeta.com>:

Torwald's public key can be used for signing, certifications and authentication; the subkey can be used for encryption.

  • Thank you, this is very helpful. Seems like this Torvalds-key has some special feature that hides the sub-key (i.e. when running gpg2 --list-keys 449FA3AB). However, the sub-key does show when running gpg2 --with-colons --list-keys 449FA3AB. What you say about separating the different key-features, with separate expiration dates, also makes good sense (However, I am still struggling to understand why I want a public key for signing, certifying other signatures, and for authentication, but that's focus of another this question, hence the parenthesis). – Eric Fail Nov 3 '14 at 13:32
  • 1
    As this actually puzzled me for a minute or two, I wrote up the answer in some Q&A: superuser.com/q/835691/102155. – Jens Erat Nov 4 '14 at 10:01

It appears that later versions of GnuPG (2.1+?) have a parameter value for --list-options that will do this:

$ gpg --list-options show-usage --list-keys

Like any of the long options this can be persisted in ~/.gnupg/gpg.conf:

list-options show-usage

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.