Can the GPG master secret key be stored as read-only?

Question

Once you have generated your master PGP key, will the "data" in the private key ever change?

For instance, if you add another subkey, uid, or any other data to the master key, do these changes need to be "written" to the "secret half of the key", modifying it in any way? Or are all changes made to the "public half of the key", or even some sort of third signed file with the details?

That is, can you store the secret key on read-only media such as a CD-ROM, printed on paper, or tattooed onto the shaved head of one of your servants?

Answer 1

Keys don't store data, they encrypt data. The data that it encrypts will change, but the key itself can't change or you would be unable to access your previously encrypted key-rings.

Now, you can role things forward to a new key by decrypting your entire key-ring and re-encrypting with a new private key, but that would only be done if your key became compromised (at which point you should really replace all your keys on your ring as well.)

Answer 2

An OpenPGP "secret key" actually consists of a whole bunch of different OpenPGP packets. For example, it will include the public and private keys, which are in the end just numbers with some header added indicating that this is a public/private key packet and what protocol is in use.

Everything else is stored in other OpenPGP packets, for example:

• user IDs
• subkeys
• signatures are used for a whole bunch of uses:
  • binding user IDs and subkeys to the primary key
  • configuration of preferred algorithms, ...
  • setting expiry dates
  • certifications you received from other keys

So everything really important is the primary private key. As long as you have this, you can revoke all (sub)keys and perform arbitrary modifications to your key at any time.

As this primary private key will also never change, you can easily store a read-only copy. If you need to load it (again), just fetch everything else (everything that is public) from a key server, and GnuPG will merge it. The only thing missing would be secret subkeys not included in your offline export, so you'd have to exchange those.