2

I'm wondering in which scenarios I would make use of GnuPG's non-default --(import|export)-options (import|export)-(clean|minimal)?

The only practical use case I can imagine is to export my public key with the command gpg --armor --export --export-options export-minimal in order to publicize it on my homepage or distribute it via e-mail so that others can encrypt messages for me or verify signatures I made.

2 Answers 2

2

Debian maintainers sometimes use keys exported with export-minimal in their source packages to verify new upstream releases. That way the keys take up less space.

0

The documentation can give you a hint as to what might be useful.

https://www.gnupg.org/documentation/manuals/gnupg-2.0/GPG-Input-and-Output.html

--export-options parameters
    This is a space or comma delimited string that gives options for
    exporting keys. Options can be prepended with a ‘no-’ to give the
    opposite meaning. The options are:

    export-local-sigs
      Allow exporting key signatures marked as "local". This is not
      generally useful unless a shared keyring scheme is being used.
      Defaults to no.

    export-attributes
      Include attribute user IDs (photo IDs) while exporting. This is
      useful to export keys if they are going to be used by an OpenPGP
      program that does not accept attribute user IDs.
      Defaults to yes.

    export-sensitive-revkeys
      Include designated revoker information that was marked as
      "sensitive".
      Defaults to no.

    export-reset-subkey-passwd
      When using the --export-secret-subkeys command, this option
      resets the passphrases for all exported subkeys to empty. This is
      useful when the exported subkey is to be used on an unattended
      machine where a passphrase doesn’t necessarily make sense. 
      Defaults to no.

    export-clean
      Compact (remove all signatures from) user IDs on the key being
      exported if the user IDs are not usable. Also, do not export any
      signatures that are not usable. This includes signatures that were
      issued by keys that are not present on the keyring. This option is
      the same as running the --edit-key command "clean" before export
      except that the local copy of the key is not modified.
      Defaults to no.

    export-minimal
      Export the smallest key possible. This removes all signatures
      except the most recent self-signature on each user ID. This option
      is the same as running the --edit-key command "minimize" before
      export except that the local copy of the key is not modified.
      Defaults to no.
1
  • Welcome to Security Stack Exchange, it would be great if you also highlighted the relevant flags. Commented Feb 9, 2022 at 18:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .