Is it safe to share an encrypted GPG private key?

Question

I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different keypair (I use a separate key just for pass).

Supposing I've exported the pass keypair as pass.sec.asc, my current thought is that I should be able to use my default (not-pass) keypair to do the following:

gpg --encrypt --armor --encrypt-to 0xMYKEY < pass.sec.asc > encrypted.asc

and upload encrypted.asc to a public location. Then, take my Yubikey to the new workstation, download encrypted.asc, and

gpg --decrypt < encrypted.asc > pass.sec.asc
gpg --import pass.sec.asc

and be able to access the passwords in my store.

• Would it be ill-advised to publish even an encrypted version of my key?
• Are there cryptographic dangers to encrypting a secret key?
• Is there a better way to bootstrap new password-store machines in a mostly-scripted way?

Answer 1

As a general rule of thumb, adding private keys ANYWHERE public is a really bad idea even in it's encrypted form.

One method that I can think of would be to have the GPG keys pushed to the new servers via SSH when they are first created. This means that the key goes directly from one server to another and doesn't end up permanently stored somewhere that anyone can get to them.

If you do decide to go with the hosting on a centralised file repository option, ensure as much security as you possibly can by ensuring the system can also be accessed with authentication from an internal network user.

Edit: Posting an update as I came up with a slightly more helpful solution + to answer a comment.

In theory, the comment saying that the key is as secure as the encryption algorithm is correct, in theory if the private key is really strongly encrypted then it's safe(ish)... however... by making that key accessible you signficantly open up the possible attack vectors. Anyone is able to challenge and attempt to decrypt that key at their leisure. A safer bet is to not only rely on the strength of a particular encryption algorithm, but to add some migitation by ensuring that the private key is kept confidential.

A really good idea for providing an initial setup of linux systems could be by using an automation tool such as ansible. My knowledge on this topic isn't quite up to scratch but from my understanding you could keep the private key secure on a single machine and using something like ansible vault to encrypt it while at rest. Ansible can then be run against the new machine that you would like to setup and it will deploy that key, ensuring that the key was not at any point publically available.