Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I'm asking myself which one is better:

  1. Use the same PGP key pair for use with both private email addresses and business email addresses
  2. Use two separate PGP key pairs, one for private and one for business email addresses

From a cryptographic standpoint there should be no difference (assuming that I keep my private key safe). But is there any kind of best practice? I'm a little bit concerned about questions like meta data privacy, traceability and so one...

Using the same key for both makes every business partner I send an signed email know my private mail addresses.

share|improve this question

migrated from Mar 7 '14 at 15:51

This question came from our site for software developers, mathematicians and others interested in cryptography.

marked as duplicate by TildalWave, Steve, Adi, Scott Pack, Xander Mar 8 '14 at 13:29

This question was marked as an exact duplicate of an existing question.

Thanks, the link you supplied answered my question. – Thekwasti Mar 6 '14 at 15:26

I use separate keys for the following reasons:

1) So my work/email is not exposed unnecessarily (not just to legit recipients but suppose a recipient's computer is compromised then you've made yourself a nice social engineering target for the bad actor since they may now have your personal and work email and possibly more if this was a work-sourced email then title and phones if in your signature)
2) So I can have different expirations
3) If I change jobs I don't have to update my home key

You would obviously also be able to have keys of differing types and sizes if that matters.

Hopefully that helps.

share|improve this answer