18

I'm looking for input on GnuPG (gpg) best practices. It's been discussed some on the gnupg-users mailing list, but I wanted to get as diverse a view as possible, so I thought to bring the topic to the experts here at SE.

I'm in the process of transitioning e-mail accounts and thought it would be a great time to also transition my GPG key. I currently have a RSA-4k key that is used for sign, certify, and encrypt all in one.

My current thoughts are to generate a new key with a certify-only primary key that would be kept offline and separate encrypt & sign subkeys for daily use. I think this would allow my Web of Trust to grow best while still protecting my data. Additionally, it would separate my encryption & signing in the (unlikely) event I am ever forced to hand over one key.

Are there pros/cons that I have not considered? Is it better to go with RSA3k in case I ever decide to use a smart card?

Improve this question

2 Answers 2

Reset to default
9

On a theoretical basis, what you envision is the "right way": a primary most-secure key which is used only to certify or revoke the keys which you will actually use. In practice, however, revocation does not work well: people with whom you have already exchanged emails will keep a copy of your public key, and will not be automatically notified of your revocation.

You may want to have distinct storage procedures for your encryption key and your signature key. If you lose your encryption private key (e.g. harddisk crash) then you can no longer decrypt incoming emails, including those that you have already received. So the encryption key should be backuped somewhere. On the other hand, the signature key should not be backuped anywhere: losing the signature private key is a minor inconvenience (you just have to create a new key and certify it) but it does not invalidate previously emitted signatures, which keep on being verifiable.

4096 bits, or even 3072 bits, are overkill for RSA, DSA or ElGamal. 2048 bits are already more than enough to ensure security against attackers who use Earth-based technology. Stating that longer keys are "more secure" is pure speculation on what future unknown attacks may look like, and if we knew how they looked like, they would not be unknown.

Improve this answer
7

In general I recommend that people use S/MIME rather than GnuPG because S/MIME is integrated into every email client that's widely in use today. However for reasons that aren't entirely clear a whole bunch of people keep insisting on using GnuPG for email security. (I use it for signing source code distributions, but that's about it.)

However, you asked for best practice, so here it is:

  • Create a large primary key for signing your other keys. Use that key to sign your other keys.

  • Create revocation certificates for your keys and store them offline. This way you'll have them if you ever lose your private keys.

  • Convince every one you might possibly want to exchange mail with to both install the GnuPG plug-in and to sign your key. (And now panic, because you've just publicly documented your relationship to anyone who gets your key.)

  • Upload your key to the key server. (And hope that nobody else uploads a key with your email address.)

If you read above you'll see two more of my complaints about the GnuPG model --- it leaks private information (who your friends are), and the key server model is just crippled.

Good luck.

Improve this answer
10
  • 1
    I was a GPG user for years. I liked it because the people who cared about signatures understood it, and the people who didn't ignored it. I switched to S/MIME when my workplace went Exchange. Most people still ignore it, but now I have to keep a list of users who can't open my emails because they lack the crypto libs. A different problem granted, but definitely a step backwards.
    – Scott Pack
    Dec 15, 2010 at 1:47
  • 2
    How do you obtain someone's S/MIME certificate anyway? (To send them mail.) I've always been bothered that with S/MIME, you're relying on some CA (and the ones that do any decent amount of checking seem to charge an arm and a leg even for a personal cert), or you're using a self-signed certificate. The other pitfall of S/MIME in my opinion is the fact that it's JUST email.
    – David
    Dec 15, 2010 at 5:10
  • 1
    @packs: I'm sorry to hear of your problem. However, your client shouldn't let you send an encrypted mail to people for whom it doesn't have a public key. And yes, there are some old versions of Outlook that won't open a signed message, but those versions should be replaced anyway because they are riddled with other security problems.
    – vy32
    Dec 15, 2010 at 15:18
  • 7
    As I understand, the main difference between S/MIME and PGP is the difference between a CA hierarchy and a web of trust. Some people don't want to trust some CAs about their email security.
    – Paŭlo Ebermann
    Oct 7, 2011 at 19:05
  • 3
    S/MIME keys are subject to third party attack just like the recent gmail.com attacks, because of a central certificate authority is compromised, so are your keys. GPG/PGP keys being web-of-security based with no central authority cannot be compromised by third parties in this way. Not understanding the difference is sad.
    – mikebabcock
    May 31, 2012 at 21:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .