I used gpg to create a key pair. I understand that a master key for signing only and a sub key for encryption only are generated. Following the Debian Wiki, I created a sub key for signing for better security, and buried my master secret key in the forest.

However, I am confused for what to publicize and how to tell people to verify with my sub key. First, I've uploaded my key to subkeys.pgp.net. But I see people publicize fingerprints on their websites, but should I do it for both of my two signing keys, and mark one of them as master and the other one sub key?


Share your full public key, which will include the public primary key, public subkeys, user IDs and certifications (and some further, special packets).

For getting your key certified (or advertising it for usage on your website), the only thing you need to exchange is your primary key's fingerprint. Signatures are issued on pairs of user IDs and primary keys, subkeys are not involved in the certification process at all.

When somebody wants to use your key and download it, his (mail) application will automatically select an encryption key (usually, the newest) - in your case, the subkey.

Primary keys are for key-management, including sharing it; subkeys are for "daily usage": signing, encryption, authentication.

| improve this answer | |
  • You said the application usually selects the newest subkey for verification of signature. What if I used multiple different sub keys for my different devices, would it work? – xuhdev Nov 13 '14 at 21:02
  • For signing, this works great, as everybody will have all public subkeys and can verify your signatures, no matter using which computer (and subsequently subkey) you issued them. For encryption, it's complicated (and hardly usable): the sender must select the appropriate subkey, and there's no way to indicate which subkey you want him to use for what device/computer/ocassion. – Jens Erat Nov 13 '14 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.