Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I created a public/secret key using Seahorse (GNOME managing tool for encryption keys). I haven't had issues encrypting and decrypting files from the computer the keys are located in but I'd like to be able to decrypt and encrypt in other computer. What is a secure way to transfer public and private keys in this case?

I ultimately copied my .gnupg directory to the second computer and Ubuntu's key manager detected both keys so after typing my passphrase I was able to open my file but I'd like to know what is a secure/proper way to do it?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

There's no better way, really (at least if you did the copy with an eavesdropping-resistant medium, e.g. through a SSH tunnel, or with a USB key). The key files being stored as files on the hard disks of both systems, this is a simple data transfer issue.

Ultimately, your private keys are protected by your passphrase.

(Of course, public keys can be transfered by any way you see fit, without any security issue: they are public.)

share|improve this answer
    
Thanks. Another question. If someone gets a copy of my private key, he wouldn't be able to read my encrypted files but he would be able to impersonate me? Is that right? –  Robert Smith Aug 21 '12 at 4:57
    
If the files are encrypted using a surrogate key protected by your private key, they'll be able to read them. –  Polynomial Aug 21 '12 at 5:50
    
Transferring public keys doesn't need confidentiality unless you're concerned about privacy, but you still need to ensure integrity. It's less of a risk in practice, but it is a security issue. –  Gilles Aug 21 '12 at 7:09

Encrypt your private key with a long password and decrypt it on the target computer. Here's how:

First, export the public key:

gpg --output public-key.gpg --export {KEYID}

Then export the secret key and encrypt the result before it's written to disk:

gpg --output - --export-secret-key {KEYID} |\
gpg --armor --output secret-key.asc --symmetric --cipher-algo AES256

Use either a very long or just entirely random password for the encryption.

Then transfer the keys.asc on a FAT-formatted flash and shred them afterwards, or if you know how to destroy CDs (ENTIRELY), use a CD and then destroy it.

To import the key on the other machine, run:

gpg --no-use-agent --output - keys.asc | gpg --import

This will prompt for your password, then decrypt and import the key.

Make sure you destroy the encrypted file after running this! On a small file like a private key bruteforcing the password is fairly trivial and can be done in a matter of weeks to months depending on the hardware available to the attacker. The attacker's job is further simplified by the fact that the structure of a PGP private key is publicly known, so known-cleartext attacks can be attempted. If the encrypted version of your private key is leaked, revoke the key and generate a new one IMMEDIATELY.

Source for the commands: http://montemazuma.wordpress.com/2010/03/01/moving-a-gpg-key-privately/

share|improve this answer
    
Excellent answer. –  Robert Smith Feb 1 at 2:38

Encrypt your public and private key before you transfer them to another computer. Use a 30 character random password. Decrypt the file on the other computer with the same password.

share|improve this answer
    
Thanks for your answer. Then other than encryption, this is the best way available. –  Robert Smith Aug 21 '12 at 4:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.