2

I am trying to wrap my head around gpg. My current understanding is that one generates a master key, and then a number of sub-keys that are cross-signed against the master key. This establishes that the sub-keys are well legitimately 'under' the master key, and gives flexibility to generate / revoke subkeys for different uses. Fine enough for me.

Then I want to make sure that I can export subkeys independently for example distribution of public keys / moving around my private keys between computers, etc. For this I generated a master key and sub-keys, and I did the following:

admjr@jf-HP:~/Desktop/for_posts$ gpg --list-keys --with-subkey-fingerprints 866A0F0CAFBF78E3100ADAEDB6B59ACF3F735A94
pub   rsa4096 2020-02-29 [SC]
      866A0F0CAFBF78E3100ADAEDB6B59ACF3F735A94
uid           [ultimate] name SURNAME (master key of name SURNAME) <name.SURNAME@domain>
sub   rsa4096 2020-02-29 [E]
      3A5F8AA232514D9D13DFAC5D8A3DE8A2403BA317
sub   rsa4096 2020-02-29 [E] [expires: 2021-02-28]
      3FFDAB789DD0A6FF7C6E3E9251F38499FF336B11

admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output export_of_name.gpg --export name.SURNAME@domain 
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output export_of_ID_main.gpg --export 866A0F0CAFBF78E3100ADAEDB6B59ACF3F735A94
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output export_of_ID_E1.gpg --export 3A5F8AA232514D9D13DFAC5D8A3DE8A2403BA317
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output export_of_ID_E2.gpg --export 3FFDAB789DD0A6FF7C6E3E9251F38499FF336B11

admjr@jf-HP:~/Desktop/for_posts$ sha256sum export_of_name.gpg 
89a4c59749614bc858a63ba0296d70f1f87ef2ca6c19237a29a986c196e2d180  export_of_name.gpg
admjr@jf-HP:~/Desktop/for_posts$ sha256sum export_of_ID_main.gpg 
89a4c59749614bc858a63ba0296d70f1f87ef2ca6c19237a29a986c196e2d180  export_of_ID_main.gpg
admjr@jf-HP:~/Desktop/for_posts$ sha256sum export_of_ID_E1.gpg 
89a4c59749614bc858a63ba0296d70f1f87ef2ca6c19237a29a986c196e2d180  export_of_ID_E1.gpg
admjr@jf-HP:~/Desktop/for_posts$ sha256sum export_of_ID_E2.gpg 
89a4c59749614bc858a63ba0296d70f1f87ef2ca6c19237a29a986c196e2d180  export_of_ID_E2.gpg

and here I am very confused. Why do all the public keys exported from the different subkeys are identical? I would expect that each subkey is a pair (private_ID, public_ID) of private and public key. It does not look like the case?

Then, looking similarly at the private keys:

admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output private_of_ID_main.gpg --export-secret-keys 866A0F0CAFBF78E3100ADAEDB6B59ACF3F735A94
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output private_of_ID_E1.gpg --export-secret-keys 3A5F8AA232514D9D13DFAC5D8A3DE8A2403BA317
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output private_of_ID_E2.gpg --export-secret-keys 3FFDAB789DD0A6FF7C6E3E9251F38499FF336B11

admjr@jf-HP:~/Desktop/for_posts$ sha256sum private_of_ID_main.gpg 
5e982d782a0a28ce264cbbd2afd04bbfd43aef61e1deec0bcad797c4c001663a  private_of_ID_main.gpg
admjr@jf-HP:~/Desktop/for_posts$ sha256sum private_of_ID_E1.gpg 
0b34781df51eec6a0f96818f74aec7ce2ae49f3af587296eb9202af5785ea5fa  private_of_ID_E1.gpg
admjr@jf-HP:~/Desktop/for_posts$ sha256sum private_of_ID_E2.gpg 
f1d9d8e63287b152bc0f045cc6174a4821910ed1c193bf54261c6a7aeb7fa696  private_of_ID_E2.gpg

This looks more like what I would expect (distinct private keys). But then just for checking:

admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output private_of_ID_main_2.gpg --export-secret-keys 866A0F0CAFBF78E3100ADAEDB6B59ACF3F735A94
admjr@jf-HP:~/Desktop/for_posts$ sha256sum private_of_ID_main_2.gpg 
90c770a7bf06a4c8c34fe252edeec149073cbf46d95d4af1c21f7df788612d8c  private_of_ID_main_2.gpg

and I get a different hash for the same subkey as I tried a few seconds before... I guess this means that when exporting private subkeys some form of timestamp is added?

I suppose this means some things are wrong in my 'mental picture' of things. So:

  • are subkeys well 'individual' pairs of (private key, public key)?
  • how to export the private and public parts of subkeys independently for each subkey?

PS: this is using gnupg on Ubuntu 18.04. Version details:

admjr@jf-HP:~/Desktop/for_posts$ gpg --version 
gpg (GnuPG) 2.2.4
libgcrypt 1.8.1
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/admjr/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.