0

I was trying to generate a new gpg keypair earlier, so ran: gpg2 --full-gen-key. I selected the default key type (RSA & RSA), keysize (2048) and specified that the key should expire in 2 years (2y). I entered my user ID and typed O for Okay.

The following was printed, followed by the details of a public key:

We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy.
We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy.

When I then typed gpg2 --fingerprint myemail@asd.com, it printed out the details of two public keys, one with an expiry date exactly 1 year from today and one with an expiry date exactly 2 years from today. Why did it generate 2 keys? Which one is the correct one, and why do they have different expiry dates? Is this expected behaviour? Before I do anything with the keys, I'd like to make sure I understand what they each correspond to.

  • By default GPG generates two separate keypairs for the same bundle. One intended to sign and verify messages, another intended to encrypt and decrypt messages with. The signing key is used to sign the full bundle of keys. – Natanael Feb 18 at 0:21
  • Thanks @Natanael. Do you know of any way to tell the two apart? – jkf Feb 18 at 1:52
  • After a bit more digging, I've realised that (as you described) there are in indeed two keypairs per bundle. What I'm therefore seeing is that two separate key bundles were generated (both with my name and email address, both today) - a total of 4 keypairs. Very strange. – jkf Feb 18 at 2:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.