Return to Answer

One of the most secure and practical way to organize PGP keys is to use Subkey with offline Master Key.

In essence, with subkeys you can store your Master/(C)ertification key in an encrypted, trusted offline storage; and your day to day workstation only have the (S)igning and (E)ncryption key. You would only take out your (C) key when you need to sign or revoke your own or someone else's key, which usually happens much less often than regular signing and encrypting.

The reason why it's recommended to use separate (S) and (E) key is because many people uses multiple devices, and you can only have one (E) key in all your devices if you want to be able to read all your encrypted data from any one of your devices, but you can use multiple (S) key, one for each of your device, and all of your devices can still verify signatures because there is a trust chain to your master key.

Also, you can put shorter expirations on your subkeys, while your master key is pretty much non-expirable.

Note that newer version of GPG creates subkeys by default.

One of the most secure and practical way to organize PGP keys is to use Subkey with offline Master Key.

In essence, with subkeys you can store your Master/(C)ertification key in an encrypted, trusted offline storage; and your day to day workstation only have the (S)igning and (E)ncryption key. You would only take out your (C) key when you need to sign or revoke your own or someone else's key, which usually happens much less often than regular signing and encrypting.

The reason why it's recommended to use separate (S) and (E) key is because many people uses multiple devices, and you can only have one (E) key in all your devices if you want to be able to read all your encrypted data from any one of your devices, but you can use multiple (S) key, one for each of your device, and all of your devices can still verify signatures because there is a trust chain to your master key.

Also, you can put shorter expirations on your subkeys. Master key is effectively non-expirable as you can always extend the expiry of a master key.

Note that newer version of GPG creates subkeys by default.

One of the most secure and practical way to organize PGP keys is to use Subkey with offline Master Key.

In essence, with subkeys you can store your Master/(C)ertification key in an encrypted, trusted offline storage; and your day to day workstation only have the (S)igning and (E)ncryption key. You would only take out your (C) key when you need to sign or revoke your own or someone else's key, which usually happens much less often than regular signing and encrypting.

The reason why it's recommended to use separate (S) and (E) key is because many people uses multiple devices, and you can only have one (E) key in all your devices if you want to be able to read all your encrypted data from any one of your devices, but you can use multiple (S) key, one for each of your device, and all of your devices can still verify signatures because there is a trust chain to your master key.

Note that newer version of GPG creates subkeys by default.

One of the most secure and practical way to organize PGP keys is to use Subkey with offline Master Key.

In essence, with subkeys you can store your Master/(C)ertification key in an encrypted, trusted offline storage; and your day to day workstation only have the (S)igning and (E)ncryption key. You would only take out your (C) key when you need to sign or revoke your own or someone else's key, which usually happens much less often than regular signing and encrypting.

The reason why it's recommended to use separate (S) and (E) key is because many people uses multiple devices, and you can only have one (E) key in all your devices if you want to be able to read all your encrypted data from any one of your devices, but you can use multiple (S) key, one for each of your device, and all of your devices can still verify signatures because there is a trust chain to your master key.

Also, you can put shorter expirations on your subkeys, while your master key is pretty much non-expirable.

Note that newer version of GPG creates subkeys by default.

One of the most secure and practical way to organize PGP keys is to use Subkey with offline Master Key.

In essence, with subkeys you store your (C)ertification key in an encrypted, trusted offline storage; and your day to day workstation only have the (S)igning and (E)ncryption key. You would only take out your (C) key when you need to sign or revoke someone's key, which usually happens much less often than regular signing and encrypting.

The reason why it's recommended to use separate (S) and (E) key is because you can only have one (E) key in all your devices if you want to be able to read all your encrypted data from any one of your devices, but you can use multiple (S) key, one for each of your device, and all of your devices can still verify the signature because they trust your master key.

Note that newer version of GPG creates (S) and (E) subkey by default.

One of the most secure and practical way to organize PGP keys is to use Subkey with offline Master Key.

In essence, with subkeys you can store your Master/(C)ertification key in an encrypted, trusted offline storage; and your day to day workstation only have the (S)igning and (E)ncryption key. You would only take out your (C) key when you need to sign or revoke your own or someone else's key, which usually happens much less often than regular signing and encrypting.

The reason why it's recommended to use separate (S) and (E) key is because many people uses multiple devices, and you can only have one (E) key in all your devices if you want to be able to read all your encrypted data from any one of your devices, but you can use multiple (S) key, one for each of your device, and all of your devices can still verify signatures because there is a trust chain to your master key.

Note that newer version of GPG creates subkeys by default.