Currently I have 3 private GPG pairs which are all master keys. I want to convert these keys into subkeys for a new key pair (and keep that in the vault).
I have read the following thread http://atom.smasher.org/gpg/gpg-migrate.txt which involes some sort of hacking the binary file to convert one master key into a subkey and replace it with another.
Is it possible to combine my different keys into a new single key pair so they still remain valid, and I can refer people to signing my master key, so I don't have to be afraid of losing my secret master key.
What I have
Here I have 3 different keys (the private key is available).
$ gpg2 -k
----------------------------------
pub 2048R/712A2BBD 2013-01-29
uid Test Key 1
sub 2048R/F0B63FDA 2013-01-29
pub 2048R/72838B89 2013-01-29
uid Test Key 2
sub 2048R/A19F06EC 2013-01-29
pub 2048D/AC349218 2013-03-21
uid Test Key 3
sub 2048g/179E9F47 2013-03-21
What I want
I like to convert the these keys into subkeys and move them to a new master key. It should look something like this instead:
pub 4096R/CB577A43 2013-03-21
uid Master Key
sub 2048R/712A2BBD 2013-01-29
sub 2048R/F0B63FDA 2013-01-29
sub 2048R/72838B89 2013-01-29
sub 2048R/A19F06EC 2013-01-29
sub 2048D/AC349218 2013-03-21
sub 2048g/179E9F47 2013-03-21
Is this even possible to do? Or Are my best hope to revoke my 3 keys and start from scratch and create a new key that fits my use.
What I done so far
Using the instructions from http://atom.smasher.org/gpg/gpg-migrate.txt
I managed to export and extracted my keys using gpgsplit. I've also changed the secret_key into a secret_subkey by changing the first byte från 0x95 to 0x9d
So that pgpdump says the secret is is a secret subkey
~/keytest/key1❯ pgpdump/pgpdump 000001-005.secret_subkey
Old: Secret Subkey Packet(tag 7)(920 bytes)
Ver 4 - new
Public key creation time - Tue Jan 29 13:09:07 CET 2013
Pub alg - RSA Encrypt or Sign(pub 1)
...
I've then merge all keys together into a new key my concatenating the files.
$ gpg2 --export-secret-key CB577A43 > master.gpg
$ cat master.gpg key1/* key2/* key3/* > newkey.gpg
# Removed ~/.gnupg
$ gpg2 --import newkey.gpg
# Ended up with this:
$ gpg -k
----------------------------------
pub 4096R/CB577A43 2013-03-21
uid Master Key
sub 2048R/208FAE4C 2013-03-21
~/keytest❯ gpg -K
----------------------------------
sec 4096R/CB577A43 2013-03-21
uid Master Key
ssb 2048R/208FAE4C 2013-03-21
ssb 2048R/712A2BBD 2013-01-29
uid Test Key 1
ssb 2048R/F0B63FDA 2013-01-29
ssb 2048R/72838B89 2013-01-29
uid Test Key 2
ssb 2048R/A19F06EC 2013-01-29
ssb 2048D/AC349218 2013-03-21
uid Test Key 3
ssb 2048g/179E9F47 2013-03-21
Which doesn't look so bad. But if I import my keys from the keyserver gpg2 --recv-keys 712A2BBD 72838B89 AC349218 to get the signatures back. It turns into this:
$ gpg -k
----------------------------------
pub 4096R/CB577A43 2013-03-21
uid Master Key
sub 2048R/208FAE4C 2013-03-21
pub 2048R/712A2BBD 2013-01-29
uid Test Key 1
sub 2048R/F0B63FDA 2013-01-29
pub 2048R/72838B89 2013-01-29
uid Test Key 2
sub 2048R/A19F06EC 2013-01-29
pub 2048D/AC349218 2013-03-21
uid Test Key 3
sub 2048g/179E9F47 2013-03-21
What remains
After this I have 4 public keys in my keyring. I wanted to move these keys so they are dependent on the master key CB577A43 like above under What I want.