I have an existing OpenPGP key which has been used infrequently. All capabilities appear to be bound to the master key, there are no subkeys.

sec   rsa4096 2014-06-02 [SCE] [expires: 2017-06-23]
  .. key details, no subkeys ..

I would like to move to a subkey for signing and a subkey for encryption, as documented by Debian. This will allow me to use a smart card and store the master key offline.

With the following background:

  • There is no indication any keys have been compromised, I just want to improve overall security by not having the master key on my PC.
  • I haven't used the key to sign anything.
  • I don't mind if I can't decrypt old data.

Can I generate two subkeys, remove the sign/encrypt capabilities from the master and keep using this key? Or is there a compelling reason to generate a completely new key with a transition statement?

1 Answer 1


If you're (somewhat) sure that the key is not compromised, I'd simply create a bunch of subkeys and move whatever keys you want to smartcards or other offline places. Adding subkeys is easily possible by using gpg[2] --edit-key and the addkey commands.

The usage flags are stored in a signature subpacket, so changing them does not change the key (with respect to it's key ID, which would invalidate all certifications). Yet, editing the usage flags in GnuPG is not possible (but by hacking the code). From a message by Resul Cetin on that mailing list thread:

Ok, it was quite easy to do (not clean, but it could be done in a fast and hackish way). Just searched for gnupg-1.4.9/g10/getkey.c:parse_key_usage and changed p to non-const and always set (*p) &=~2;. Afterwards I started my new compiled hackish-gpg --edit-key and set the expire of my master key. After this procedure I had only the Cert flag set. Thanks Christoph - you are my personal hero of the day :)

Personally, I would not care too much for the master key's usage flag. If an attacker gets hold of the primary key, he would be able to change the usage flags, anyway.

  • Thanks, this works fine. Easier with GPG 2.1 which has useful commands like --export-secret-subkeys but possible with older versions too.
    – David
    Commented Jun 29, 2016 at 12:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .