The tutorial for creating and storing keys on an OpenPGP smartcard with GPG by the Free Software Foundation (FSF) at wiki.fsfe.org recommends creating a main and sub key for encryption, where the main key should not be stored on the card.

While the merit of a main key and sub keys (for authentication, signing and encryption) is amply documented, what's the merit of a main and sub key specifically for encryption?


That documentation is a bit weird. The reason why there is a "main encryption subkey" is, that the master key in that documentation is created as a DSA key. And since DSA can only be used for signatures and not for encryption, gpg automatically creates a subkey for that purpose (for the ElGamal algorithm).

Since you are creating two more subkeys lateron (of type RSA), that ElGamal key is not needed anymore and thus deleted.

In the end you have one master key which you should only use to sign and revoke other keys and keep offline, and two subkeys for your daily use: One for signing, one for decrypting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.