Is it possible to have a different passphrase for a GPG subkey?

The reason is that I'm using duplicity to back up my files, and it needs the key passphrase to sign the files.

Since I want run duplicity automatically, I would have to store the passphrase in an environment variable. I don't feel comfortable storing my main key's passphrase in an environment variable, so I'm wondering if I could have a different passphrase for the subkey that does the signing.


My recommendation is to use a completely separate key. Because you're signing backups, only you need to trust the separate key, so there's not a web of trust issue here. You can even sign it with your main key, if you like.

A second option is to load a gpg-agent and load the key. You'll need to set max-cache-ttl=-1 and default-cache-ttl=-1 to allow it to keep the key indefinitely. You'll still need to type in the passphrase once per boot. (I haven't tested the -1 options, that's based on reading the code that -1 is infinite.)

If you don't want to do that, you could copy your GNUPGHOME (~/.gnupg, typically), delete the other subkeys, and change the passphrase on the key. Then have duplicity use this subkey-only installation with the new passphrase. (Just set the GNUPGHOME environment variable to work with the different home directory.)

  • I'll take your advice and create a separate key, since it will also be easier to manage. Thanks! Jun 10 '14 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.