Using different GPG keys for encrypting emails and encrypting personal files?

Question

I'm going to use GPG for

1. Signing my documents

2. Encrypting emails

3. Encrypting my personal documents.

Will it be better for security measures to use different encryption keys for 2 and 3? For 3, it is just for encrypting my personal files and I think using the same key for encrypting and receiving emails which of course, published to the public will be a security risk.

Answer 1

This depends on your threat model. From a purely cryptographic perspective, there is no downside to encrypting different types of data with the same key. GnuPG creates a master key which is used only for signing, and then creates, by default, a single subkey for encryption. I take it you are asking whether or not you should use that single subkey or you should create an additional subkey?

The main reason to create a new subkey is to facilitate key management. You have increased control and can, for example, revoke one subkey without revoking the other. You can also use different passwords for each key, or even keep them on different media (such as smart cards), reducing the risk of compromise. Compartmentalizing each subkey and assigning it to a particular task is often good practice reasons like this, even if there is no specific security risk in terms of cryptography to using the same key for two distinct purposes.

I think I should point out that you may not want to encrypt personal documents with asymmetric cryptography. If you are the only one who will be encrypting and decrypting the files, you should instead use a symmetric cipher, such as AES. GnuPG supports pure symmetric encryption without using an RSA keypair. This has the benefit of being more efficient, as well as not being vulnerable to advances in quantum computing or breakthroughs in integer factorization.