Safely remove an expired PGP key file

Question

since it's possible to recover a deleted file I wonder how one can safely remove a PGP key file (with linux's command line tools) so that it's impossible to recover it. Maybe some dd command? Searched but couldn't find anything.

Answer 1

Update:

@ryran's comment below is correct. You should use the shred tool (included with all Linux distros) rather than the method described below. The shred tool operates in a similar way, but is designed specifically for the purpose of secure file deletion.

---

As Graham Hill commented, the only 100% secure measure is physical destruction of the medium, but you can go as far as gaining an overwhelming level of irrecoverability with standard tools you will find on any Linux distribution.

Use:

ls -l

in the directory the key is located to find its size in bytes. You can then use:

dd if=/dev/urandom of=./<keyfile name> bs=<size of key file in bytes> count=1

to write random data over they key.

This command will write data from /dev/urandom (an unblocking stream of psuedo-random bytes) over the key file. Do this multiple times for extra security, I think 7 is often recommended but even once will make recovery impractical for most attackers.

Answer 2

For "impossible to recover" you need to physically destroy the disk, I´m afraid.

Of course, depending on your threat model, you may very well be comfortable with something less drastic. In which case, you probably have at least one of shred, srm, or wipe bundled with your Linux distro.