8

I recently started to use GPG and I wanted to import my secret key from another computer. I was thinking about sending it to myself by email or using an USB storage device.

Question : Is it safe ? Could someone use my private key it if they were to find it ? And if it is the case, would generate another pair of keys be enough to stop him from stealing my indentity ?

Thanks.

Improve this question
1
  • Regardless of whether you transport the secret key using a physical medium or send it to yourself via the internet, I would suggest you encrypt the exported key and password protect it. For example GNU Privacy Guard has a Symmectric Cipher feature. Alternatively you could use a tool like 7zip to created an AES encrypted ZIP archive. This way if someone does intercept your transfer attempt, they still have to either get the password, or break the encryption before they can get access to your key. As symcbean pointed out, it would also be good to have passphrase for your secret key.
    – Robin Hood
    Jun 30, 2016 at 20:15

1 Answer 1

Reset to default
5

Yes, someone with access to your key can logon anywhere the corresponding public key is deployed, gaining access to your data and with the potential to do further mischief ("stealing my identity" is a bit vague).

Carrying the key on a USB stick should mean the key is less exposed than sending it over the internet.

If you don't have a passphrase on the key, then you might consider adding one before exporting it (gpg --edit-key $KEY / passwd) or encrypting the exported file gpg -e --symmetric $yourExportedIdFile).

If the private key was compromised then you'd need to remove/revoke the public keys from all the places they've been deployed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .