7

I'm looking a way to generate a GPG key with a given expiration date. In GPG/GPG2, when you create a new key you can set a date only in signature, but the key expiration date is always set to zero.

:public key packet:
        version 4, algo 1, created 1417388459, expires 0
        pkey[0]: [2048 bits]
        pkey[1]: [17 bits]
:user ID packet: "my user id mymail"
:signature packet: algo 1, keyid mykeyid
        version 4, created 1417688533, md5len 0, sigclass 0x13
        digest algo 2, begin of digest f0 52
        hashed subpkt 27 len 1 (key flags: 03)
        hashed subpkt 9 len 4 (key expires after 5y31d23h59m)
        hashed subpkt 11 len 5 (pref-sym-algos: 9 8 7 3 2)

I found some discussion about why GPG handle the expiration (https://davesteele.github.io/gpg/2014/09/20/anatomy-of-a-gpg-key/ is a good starting point) but I don't know if there is a way to set an expiration for your primary key.

How to create a primary key with the expiration date set?

1 Answer 1

10

when i type gpg2 --full-gen-key, right after selecting the algo and keysize, i get this prompt:

Please specify how long the key should be valid.
     0 = key does not expire
  <n>  = key expires in n days
  <n>w = key expires in n weeks
  <n>m = key expires in n months
  <n>y = key expires in n years
Key is valid for? (0) 

This configures the validity of your primary key. Is this what you're after?

Edit: the "expires:0" is perfectly normal for every GPG generated key, as GPG simply does not use this field for setting an expiration. This is done in the self-signature; the internal proof that the user ID provided is valid for the given public key. This is done for flexibility reasons as described in the source you mention https://davesteele.github.io/gpg/2014/09/20/anatomy-of-a-gpg-key/

5
  • No, this changes/set the expiration of signature, not the exp of the key, anyway thanks to point to --full-gen-key I'll investigate further in this direction Commented Nov 14, 2016 at 8:43
  • Because this is what the above prompt, as well as the 'expire' command does according to the official docs: Change the key expiration time. If a key is selected, the time of this key will be changed. With no selection the --key expiration of the primary key- is changed
    – J.A.K.
    Commented Nov 15, 2016 at 8:18
  • Check the above key dump: in public key packet exoiration is always zero. I tried also to use edit-key to change date. Commented Nov 15, 2016 at 9:19
  • 1
    This is normal. I've updated my answer to reflect this detail.
    – J.A.K.
    Commented Nov 16, 2016 at 16:10
  • In your installation the first word of the command may very well be just gpg instead of gpg2. In Debian 11 I have gpg. And gpg2 would only come as a symlink if I installed the dummy transitional package gnupg2. Commented Nov 2, 2023 at 9:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .