When encrypting or decrypting documents on a computer that isn't my daily driver I need to import my key to the keychain, do the encrypt/decrypt then remove the keychain and from the computer. As a security considering person I know that still leaves the key on the computer whether indexed or not, so it can be recovered.

Is there any way to encapsulate all the functionally of a GnuPG keychain but on a portable USB stick.

This way when you are done with encrypting/decrypting you can just remove the USB.

Like a Yubico stick but with GnuPG private and public keys on.

  • Yubikeys supports the OpenPGP applet and can be used to hold keypairs to sign and decrypt. The Neo model also works with OpenKeychain on Android using NFC. – Natanael Jan 8 '16 at 10:05
  • OpenPGP smart cards do not store the public key. You can only use them together with a local copy of the key. – Jens Erat Jan 8 '16 at 17:41

OpenPGP smart cards do not store the public key. You can only use them together with a local copy of the key. As a consequence, you cannot use the various OpenPGP smart cards, including YubiKeys and Nitrokeys without leaving traces on the host machine.

You can use a GnuPG key ring on a thumb drive by moving the whole GnuPG home directory there, and either setting the --homedir option to gpg or the GNUPGHOME environment variable. From man gpg:

   --homedir dir
          Set  the  name  of the home directory to dir. If this option is not
          used, the home directory defaults to ‘~/.gnupg’.  It is only recognized
          when given on the command line.
          It also overrides any home directory  stated  through  the  environment
          variable  ‘GNUPGHOME’  or  (on  Windows  systems)  by  means  of  the
          Registry  entry  HKCU\Soft‐ware\GNU\GnuPG:HomeDir.

You could even use a USB thumb drive for your GnuPG home directory together with a YubiKey to hold the private keys for use on (somewhat) untrusted machines.

Still pay attention to possible traces in the command line history, temp folder, system logs, ... Using some operating system without leaving any traces is hardly possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.