Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for input on GnuPG (gpg) best practices. It's been discussed some on the gnupg-users mailing list, but I wanted to get as diverse a view as possible, so I thought to bring the topic to the experts here at SE.

I'm in the process of transitioning e-mail accounts and thought it would be a great time to also transition my GPG key. I currently have a RSA-4k key that is used for sign, certify, and encrypt all in one.

My current thoughts are to generate a new key with a certify-only primary key that would be kept offline and separate encrypt & sign subkeys for daily use. I think this would allow my Web of Trust to grow best while still protecting my data. Additionally, it would separate my encryption & signing in the (unlikely) event I am ever forced to hand over one key.

Are there pros/cons that I have not considered? Is it better to go with RSA3k in case I ever decide to use a smart card?

share|improve this question
add comment

2 Answers

up vote 7 down vote accepted

On a theoretical basis, what you envision is the "right way": a primary most-secure key which is used only to certify or revoke the keys which you will actually use. In practice, however, revocation does not work well: people with whom you have already exchanged emails will keep a copy of your public key, and will not be automatically notified of your revocation.

You may want to have distinct storage procedures for your encryption key and your signature key. If you lose your encryption private key (e.g. harddisk crash) then you can no longer decrypt incoming emails, including those that you have already received. So the encryption key should be backuped somewhere. On the other hand, the signature key should not be backuped anywhere: losing the signature private key is a minor inconvenience (you just have to create a new key and certify it) but it does not invalidate previously emitted signatures, which keep on being verifiable.

4096 bits, or even 3072 bits, are overkill for RSA, DSA or ElGamal. 2048 bits are already more than enough to ensure security against attackers who use Earth-based technology. Stating that longer keys are "more secure" is pure speculation on what future unknown attacks may look like, and if we knew how they looked like, they would not be unknown.

share|improve this answer
add comment

In general I recommend that people use S/MIME rather than GnuPG because S/MIME is integrated into every email client that's widely in use today. However for reasons that aren't entirely clear a whole bunch of people keep insisting on using GnuPG for email security. (I use it for signing source code distributions, but that's about it.)

However, you asked for best practice, so here it is:

  • Create a large primary key for signing your other keys. Use that key to sign your other keys.

  • Create revocation certificates for your keys and store them offline. This way you'll have them if you ever lose your private keys.

  • Convince every one you might possibly want to exchange mail with to both install the GnuPG plug-in and to sign your key. (And now panic, because you've just publicly documented your relationship to anyone who gets your key.)

  • Upload your key to the key server. (And hope that nobody else uploads a key with your email address.)

If you read above you'll see two more of my complaints about the GnuPG model --- it leaks private information (who your friends are), and the key server model is just crippled.

Good luck.

share|improve this answer
vy - would you use gpg for other purposes. I understand S/MIME for mail (although I find it causes all sorts of problems with mail between Notes and Outlook clients, but that is probably a separate issue :-) but what would be your preferred options for other encryption practices? For various things I have used pgp, gpg, truecrypt, others - and have no issues with them but always keen to see the opinions of others. –  Rory Alsop Dec 14 '10 at 21:49
How do you obtain someone's S/MIME certificate anyway? (To send them mail.) I've always been bothered that with S/MIME, you're relying on some CA (and the ones that do any decent amount of checking seem to charge an arm and a leg even for a personal cert), or you're using a self-signed certificate. The other pitfall of S/MIME in my opinion is the fact that it's JUST email. –  David Dec 15 '10 at 5:10
@packs: I'm sorry to hear of your problem. However, your client shouldn't let you send an encrypted mail to people for whom it doesn't have a public key. And yes, there are some old versions of Outlook that won't open a signed message, but those versions should be replaced anyway because they are riddled with other security problems. –  vy32 Dec 15 '10 at 15:18
As I understand, the main difference between S/MIME and PGP is the difference between a CA hierarchy and a web of trust. Some people don't want to trust some CAs about their email security. –  Paŭlo Ebermann Oct 7 '11 at 19:05
S/MIME keys are subject to third party attack just like the recent gmail.com attacks, because of a central certificate authority is compromised, so are your keys. GPG/PGP keys being web-of-security based with no central authority cannot be compromised by third parties in this way. Not understanding the difference is sad. –  mikebabcock May 31 '12 at 21:00
show 5 more comments

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.