This question already has an answer here:

I'm asking myself which one is better:

  1. Use the same PGP key pair for use with both private email addresses and business email addresses
  2. Use two separate PGP key pairs, one for private and one for business email addresses

From a cryptographic standpoint there should be no difference (assuming that I keep my private key safe). But is there any kind of best practice? I'm a little bit concerned about questions like meta data privacy, traceability and so one...

Using the same key for both makes every business partner I send an signed email know my private mail addresses.

marked as duplicate by TildalWave, Steve, Adi, Scott Pack, Xander Mar 8 '14 at 13:29

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from crypto.stackexchange.com Mar 7 '14 at 15:51

This question came from our site for software developers, mathematicians and others interested in cryptography.


I use separate keys for the following reasons:

1) So my work/email is not exposed unnecessarily (not just to legit recipients but suppose a recipient's computer is compromised then you've made yourself a nice social engineering target for the bad actor since they may now have your personal and work email and possibly more if this was a work-sourced email then title and phones if in your signature)
2) So I can have different expirations
3) If I change jobs I don't have to update my home key

You would obviously also be able to have keys of differing types and sizes if that matters.

Hopefully that helps.