8

The GnuPG documentation lists an option called --export-options parameters. One of the possible parameters for this option is backup (aliased export-backup).

The description for --export-options backup states:

Export for use as a backup. The exported data includes all data which is needed to restore the key or keys later with GnuPG. The format is basically the OpenPGP format but enhanced with GnuPG specific data. All other contradicting options are overridden.

What data is included in "all data which is needed to restore the key or keys later?"

When the documentation says, "is basically the OpenPGP format but enhanced with GnuPG specific data," what enhancing data is it talking about?

In stating "other contradicting options are overridden," what contradicting options are being referred to?

2 Answers 2

5

What data is included in "all data which is needed to restore the key or keys later?"

It includes the key(s), user attributes, signatures (including local signatures), and ownertrust values. Everything required to completely restore the key(s) and trust database as they currently exist in your gnupg directory.

When the documentation says, "is basically the OpenPGP format but enhanced with GnuPG specific data," what enhancing data is it talking about?

Ownertrust data contained in the exported Trust packets. These are specific to GnuPG and not necessarily transferable to other implementations.

From RFC-4880:

5.10.  Trust Packet (Tag 12)

   The Trust packet is used only within keyrings and is not normally
   exported.  Trust packets contain data that record the user's
   specifications of which key holders are trustworthy introducers,
   along with other information that implementing software uses for
   trust information.  The format of Trust packets is defined by a given
   implementation.

   Trust packets SHOULD NOT be emitted to output streams that are
   transferred to other users, and they SHOULD be ignored on any input
   other than local keyring files.

In stating "other contradicting options are overridden," what contradicting options are being referred to?

Any options that would restrict what is exported. For example, export options no-export-local-sigs, no-export-attributes, export-clean, etc.

3

When you export your (private) data as backup, then it contains your private-key. But to really be able to use this backup you often need some more information.

Example: You have used an elliptic curve to generate your private key. Then you must also export the curve-parameters to be able to use your backuped private-key when you need it.

1
  • 5
    Yes, of course. So is this type of information included in --export-options backup? I'm just trying to understand this awful documentation. Commented Dec 29, 2020 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .