5

I'm looking a way to generate a GPG key with a given expiration date. In GPG/GPG2, when you create a new key you can set a date only in signature, but the key expiration date is always set to zero.

:public key packet:
        version 4, algo 1, created 1417388459, expires 0
        pkey[0]: [2048 bits]
        pkey[1]: [17 bits]
:user ID packet: "my user id mymail"
:signature packet: algo 1, keyid mykeyid
        version 4, created 1417688533, md5len 0, sigclass 0x13
        digest algo 2, begin of digest f0 52
        hashed subpkt 27 len 1 (key flags: 03)
        hashed subpkt 9 len 4 (key expires after 5y31d23h59m)
        hashed subpkt 11 len 5 (pref-sym-algos: 9 8 7 3 2)

I found some discussion about why GPG handle the expiration (https://davesteele.github.io/gpg/2014/09/20/anatomy-of-a-gpg-key/ is a good starting point) but I don't know if there is a way to set an expiration for your primary key.

How to create a primary key with the expiration date set?

1 Answer 1

8

when i type gpg2 --full-gen-key, right after selecting the algo and keysize, i get this prompt:

Please specify how long the key should be valid.
     0 = key does not expire
  <n>  = key expires in n days
  <n>w = key expires in n weeks
  <n>m = key expires in n months
  <n>y = key expires in n years
Key is valid for? (0) 

This configures the validity of your primary key. Is this what you're after?

Edit: the "expires:0" is perfectly normal for every GPG generated key, as GPG simply does not use this field for setting an expiration. This is done in the self-signature; the internal proof that the user ID provided is valid for the given public key. This is done for flexibility reasons as described in the source you mention https://davesteele.github.io/gpg/2014/09/20/anatomy-of-a-gpg-key/

4
  • No, this changes/set the expiration of signature, not the exp of the key, anyway thanks to point to --full-gen-key I'll investigate further in this direction Nov 14, 2016 at 8:43
  • Because this is what the above prompt, as well as the 'expire' command does according to the official docs: Change the key expiration time. If a key is selected, the time of this key will be changed. With no selection the --key expiration of the primary key- is changed
    – J.A.K.
    Nov 15, 2016 at 8:18
  • Check the above key dump: in public key packet exoiration is always zero. I tried also to use edit-key to change date. Nov 15, 2016 at 9:19
  • 1
    This is normal. I've updated my answer to reflect this detail.
    – J.A.K.
    Nov 16, 2016 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.