In GnuPG I have a master key that doesn't expire, with separate subkeys with one year expiration time for encryption, authentication, and signing. If I update the expiration dates of my subkeys, will I need to make new backup copies of my private master key?


The expiration date of subkeys is stored in a special kind of signature issued by the primary master key on the subkey. With other words, if you change the expiration date, no private keys are changed at all. If you can restore the public key later (for example, fetching it from the key server network), you're fine.

  • Thanks! I read somewhere that private keys also contain full copies of public keys (and subkeys). Would there be conflicts if I tried to import my backup private key into a keyring where I already held the updated versions of my public subkeys? I tried doing it and it did not complain. – Jean Jul 18 '16 at 10:13
  • The private keys have the public key information attached, that's right. But the settings packets have a creation timestamp attached, so the newer ones (from key servers, ...) will overrule the old ones from the backup. Anyway, as long as you have the private primary key, you could easily extend the expiration period again. – Jens Erat Jul 18 '16 at 11:07
  • Makes sense, thanks. For completeness's sake, does the same apply to editing/adding/removing UIDs, photo IDs, signatures, etc? – Jean Jul 19 '16 at 0:07
  • Everything included in the public key is available this way. Obviously, you still need the private keys for private key operations (the private primary key for key management, the private encryption subkeys for decryption of encrypted messages, signing subkeys are only required for signatures and can be recreated arbitrarily). – Jens Erat Jul 19 '16 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.