I created a master gpg key and additional signing subkey as described on Debian wiki page. I also moved the whole .gnupg directory to /my/save/place and deleted the primary key from the original .gnupg directory. So far so good, gpg2 -K shows a sec# instead of sec and gpg2 --homedir=/my/save/place -K shows sec as expected.

Hovewer, if I run gpg2 --export-secret-keys --armor and gpg2 --homedir=/my/save/place --export-secret-keys --armor both commands return something. Although results are different.

  • Could you please explain what exactly is returned in the former and the latter cases?
  • What command one should run to get a private key to save with paperkey afterwards?

Where you have the full copy of your key requesting to export the secret key will export the secret master key plus any subkeys, the corresponding public keys and signatures by the master key on the subkeys.

Where you have removed the private master key you will get all that minus the private master key. That is you'll get any subkeys (public and private), signatures on them from the master key and the public master key (necessary to validate the subkey signatures).

gpg2 --homedir=/my/save/place --export-secret-keys should produce something suitable for paperkey

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.