I’m learning about key management, encryption and GPG for provenance (verifying authorship). Using DevDungeon’s GPG Tutorial I learned that to export your GnuPG private key to your local computer, you use this command:
$ gpg --export-secret-keys --armor XXX > ./my-priv-gpg-key.asc (where XXX is your unique hexadecimal identifier). Yesterday I used this command to generate the secret plain text secret key which I moved to cold storage. But today I invoked the same gpg command and entered the same passphrase which generated a new plain text secret key. I compared the two (yesterday’s key and today’s key) using the same utility I use to view changes made to source code in git (p4merge). I noticed that the two gpg keys are slightly different. Roughly half is the same and the other half is brand new.
Now for my uber naive questions:
- Is this a bad idea? If so, could someone clarify why this is a bad idea?
- Should I only use the first one and delete the second one? Or is it perfectly alright for me to use either one going forward? Which one should I use?
I Googled 'generating duplicate gpg private keys' and similar search terms but I had a hard time finding a discussion regarding my questions above. I also Googled ‘managing multiple private keys gnupg’ which turned up links to the official GnuPG manual on the topic of Key Management which was interesting but doesn’t answer my questions specifically.