4

I've created a Keybase account, and imported the "easy" identities (e.g. Twitter, Reddit). Now it's time to get my PGP key there.

I had expected instructions to PGP-sign a specific text from the Keybase (Windows) app and re-upload that signed data (base64 or some such). Instead, what I find is this:

# import a key from gpg's key chain
keybase pgp select
#import from stdin and send the public half to Keybase
cat privkey.asc | keybase pgp import
# for more options
keybase pgp help

At first I thought that they were 3 instructions to be followed in order, but then I realized they were 3 different main things you could do.

Can someone explain in basic terms (I know the basics of PGP and public/private key pairs) what the first two options entail behind the scenes?

Specific questions I'd have:

  • Does either option 1 or 2 give permanent access for the Keybase app to my PGP private key? Or is it just one time to sign a proof that the public key is mine?
  • Does option 2 mean you need to have your private key in a file at your current location? Is the file typically protected with your passphrase?
  • Any other specific risks or things I should be aware of? I want to make very sure my PGP private key remains my own.

I can speculate to the answers myself, but since it's important stuff I'd rather ask, to be sure.

1

It sounds like you're looking for any one of these three

keybase pgp import -i pubkey.txt
cat pubkey.txt | keybase pgp import
keybase pgp select --no-import

To import the public half of your key, advertise it on keybase, but prevent them from having access to the private key.

cat privkey.asc | keybase pgp import

will send a copy of your private key to the keybase servers, which will make it available for use with keybase pgp commands.

keybase pgp select

will look at your GnuPG keyring and allow you to select an existing private key to import to keybase.

When in doubt

keybase pgp <option> help

Update:

The option to upload a public key and withhold the private half from keybase doesn't seem to be working. The first set of options listed above now all return

  • ERROR No secret key available
  • 1
    It doesn't seem like the 1st option "import and advertise your public key but prevent them from having access to the private key" is available anymore. And I'm not comfortable giving keybase access to my private gpg key. – Mike Lippert Oct 12 '18 at 20:57
  • keybase pgp select -h shows " keybase pgp select - Select a key as your own and register the public half with the server". If you pipe the public key to keybase pgp import they have no way of obtaining the private half. What led you to believe that option isn't available anymore? – user8675309 Oct 12 '18 at 21:06
  • 1
    I just tried it and got the following: gpg2 --armor --export me@actualdomain.com | keybase pgp import ▶ ERROR No secret key available – Mike Lippert Oct 12 '18 at 21:14
  • Just generated a new key to try it with, I'm getting the same results. Hopefully it's just a bug, I also wouldn't upload my private key. – user8675309 Oct 12 '18 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.