I am trying to wrap my head around gpg. My current understanding is that one generates a master key, and then a number of sub-keys that are cross-signed against the master key. This establishes that the sub-keys are well legitimately 'under' the master key, and gives flexibility to generate / revoke subkeys for different uses. Fine enough for me.
Then I want to make sure that I can export subkeys independently for example distribution of public keys / moving around my private keys between computers, etc. For this I generated a master key and sub-keys, and I did the following:
admjr@jf-HP:~/Desktop/for_posts$ gpg --list-keys --with-subkey-fingerprints 866A0F0CAFBF78E3100ADAEDB6B59ACF3F735A94
pub rsa4096 2020-02-29 [SC]
866A0F0CAFBF78E3100ADAEDB6B59ACF3F735A94
uid [ultimate] name SURNAME (master key of name SURNAME) <name.SURNAME@domain>
sub rsa4096 2020-02-29 [E]
3A5F8AA232514D9D13DFAC5D8A3DE8A2403BA317
sub rsa4096 2020-02-29 [E] [expires: 2021-02-28]
3FFDAB789DD0A6FF7C6E3E9251F38499FF336B11
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output export_of_name.gpg --export name.SURNAME@domain
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output export_of_ID_main.gpg --export 866A0F0CAFBF78E3100ADAEDB6B59ACF3F735A94
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output export_of_ID_E1.gpg --export 3A5F8AA232514D9D13DFAC5D8A3DE8A2403BA317
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output export_of_ID_E2.gpg --export 3FFDAB789DD0A6FF7C6E3E9251F38499FF336B11
admjr@jf-HP:~/Desktop/for_posts$ sha256sum export_of_name.gpg
89a4c59749614bc858a63ba0296d70f1f87ef2ca6c19237a29a986c196e2d180 export_of_name.gpg
admjr@jf-HP:~/Desktop/for_posts$ sha256sum export_of_ID_main.gpg
89a4c59749614bc858a63ba0296d70f1f87ef2ca6c19237a29a986c196e2d180 export_of_ID_main.gpg
admjr@jf-HP:~/Desktop/for_posts$ sha256sum export_of_ID_E1.gpg
89a4c59749614bc858a63ba0296d70f1f87ef2ca6c19237a29a986c196e2d180 export_of_ID_E1.gpg
admjr@jf-HP:~/Desktop/for_posts$ sha256sum export_of_ID_E2.gpg
89a4c59749614bc858a63ba0296d70f1f87ef2ca6c19237a29a986c196e2d180 export_of_ID_E2.gpg
and here I am very confused. Why do all the public keys exported from the different subkeys are identical? I would expect that each subkey is a pair (private_ID, public_ID) of private and public key. It does not look like the case?
Then, looking similarly at the private keys:
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output private_of_ID_main.gpg --export-secret-keys 866A0F0CAFBF78E3100ADAEDB6B59ACF3F735A94
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output private_of_ID_E1.gpg --export-secret-keys 3A5F8AA232514D9D13DFAC5D8A3DE8A2403BA317
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output private_of_ID_E2.gpg --export-secret-keys 3FFDAB789DD0A6FF7C6E3E9251F38499FF336B11
admjr@jf-HP:~/Desktop/for_posts$ sha256sum private_of_ID_main.gpg
5e982d782a0a28ce264cbbd2afd04bbfd43aef61e1deec0bcad797c4c001663a private_of_ID_main.gpg
admjr@jf-HP:~/Desktop/for_posts$ sha256sum private_of_ID_E1.gpg
0b34781df51eec6a0f96818f74aec7ce2ae49f3af587296eb9202af5785ea5fa private_of_ID_E1.gpg
admjr@jf-HP:~/Desktop/for_posts$ sha256sum private_of_ID_E2.gpg
f1d9d8e63287b152bc0f045cc6174a4821910ed1c193bf54261c6a7aeb7fa696 private_of_ID_E2.gpg
This looks more like what I would expect (distinct private keys). But then just for checking:
admjr@jf-HP:~/Desktop/for_posts$ gpg --armor --output private_of_ID_main_2.gpg --export-secret-keys 866A0F0CAFBF78E3100ADAEDB6B59ACF3F735A94
admjr@jf-HP:~/Desktop/for_posts$ sha256sum private_of_ID_main_2.gpg
90c770a7bf06a4c8c34fe252edeec149073cbf46d95d4af1c21f7df788612d8c private_of_ID_main_2.gpg
and I get a different hash for the same subkey as I tried a few seconds before... I guess this means that when exporting private subkeys some form of timestamp is added?
I suppose this means some things are wrong in my 'mental picture' of things. So:
- are subkeys well 'individual' pairs of (private key, public key)?
- how to export the private and public parts of subkeys independently for each subkey?
PS: this is using gnupg on Ubuntu 18.04. Version details:
admjr@jf-HP:~/Desktop/for_posts$ gpg --version
gpg (GnuPG) 2.2.4
libgcrypt 1.8.1
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Home: /home/admjr/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2
