Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a desktop computer and a laptop computer both running Debian. All of the devices have encrypted hard drives. I also have a phone running Cyanogenmod/Android.

What is the best way to manage the keys?

Ideally I want to be able to list one Public Key.

share|improve this question

1 Answer 1

The obvious answer is to use gpg -a --export-secret-key and gpg --import to share the one key you have across the devices. (Some people suggest copying the ~/.gnupg/secring.gpg file, or, even worse, the entire ~/.gnupg/ directory. Do not do that; I've come across subtle bugs that make the binary format not portable across implementations, although if you stick to only recent GnuPG, you are almost certainly fine; differences in gpg.conf might bite you though, so it's still better to export/import the keys all the time.) – This is the scheme I normally use (I do not own an Android device).

If you have systems with varying security levels – for example, Cyanogen has this phone-home backdoor – you may want to use a subkey scheme instead: you create a sign-only key first, then create two or more subkeys (one sign-only subkey with which you can sign messages and (if necessary: do not normally do that, use your master key for it) other keys, and one encrypt-only subkey with which you can decrypt eMails others encrypt to this subkey). Then, you only export those subkeys you need on the less-trusted device to it. The Debian Wiki has got very detailed instructions on how to do this; the gist is, you first export the entire key into a backup, then delete locally the “master” subkey, then export again (this time missing the master, keeping only the subkeys you actually want to export), then import the backup file created in the first step. Import only the second export on the device.

Do not create multiple keys. People will be confused over which one to use.


I'm willing to add more specifics; this is a somewhat generic answer; more detail depends on your use cases (e.g. do you want to read encrypted mail on all devices or just one, or do you want to read only some encrypted mail on all devices but have other encrypted mail your Android device cannot access; and what about signing).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.