Generate a PGP key with more than 4096 bits?

Question

I would like to know if generating a PGP key with a number of bits higher than 4096 is possible and if so how?

Answer 1

Yes, though some source code twiddling may be needed, you can generate 8,192 bit keys. In fact, I've seen some instances of 16,384 bit keys generated courtesy of the "Cyber Knights Templar (CKT)" builds of PGP "back in the day."

This blog post gives you an idea of where to look in the GnuPG source to bump that limit.

There are no different legal encumbrances to key sizes larger than 4,096 than there are to 4,096 bit keys. Just know that since there aren't a lot of keys larger than 4,096 bits floating around, the software of others might not work with them. I'm a bit curious to look into that now.

Answer 2

From the OpenPGP standard:

OpenPGP does not put limits on the size of public keys. However, larger keys are not necessarily better keys. Larger keys take more computation time to use, and this can quickly become impractical. Different OpenPGP implementations may also use different upper bounds for public key sizes, and so care should be taken when choosing sizes to maintain interoperability. As of 2007 most implementations have an upper bound of 4096 bits.

So this is "legal" but not really recommended if you want your key to be usable by other people who would like to send encrypted messages to you, and to verify messages you sign. (And if you do not want it, why bother having a public key at all ?)

GnuPG 1.4.11 appears to support RSA keys up to 4096 bits, and DSA keys up to 3072 bits. It will not go beyond.

Answer 3

gpg --batch --gen-key <<EOF
Key-Type: RSA
Key-Length: 16384
Name-Real: NAME
Name-Comment: COMMENT
Name-Email: EMAIL
Passphrase: PASSWORD
EOF

However, no no sub keys are created. Do not sign and encrypt with the same key.