Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I plan to create a 4096 bit RSA&RSA key pair:
gpg --gen-key --personal-digest-preferences SHA512 --cert-digest-algo SHA512
Is there any difference in generated key quality between versions 1.4 (classic), 2.0 (stable), and 2.1 (modern)?
Background: I consider creating the key on a cleanly booted Debian stable live system, and that comes with GnuPG version 1.4.12.
All versions of GnuPG mentioned are (as of 2015) still maintained and updated. Differences are mainly of architectural kind; classic (1.4) is proposed to be used within for server and embedded platforms (from man gpg2), while stable and modern are recommended for desktop use (having more dependencies, but being more modular and flexible). GnuPG 2.1 heavily relies on the gpg-agent for all operations requiring the secret key, which delegates the most risky operations to a much smaller piece of software with less exposure to vulnerabilities.
Keys created with all of those versions are equally secure, and can be arbitrarily interchanged with the other versions (by importing/exporting). There are no known vulnerabilities regarding key generation within all those versions.
Also, while 1.4.12 is seemingly outdated as 1.4.14 resolving critical issues is published, Debian backports relevant security patches to older versions to keep the packages stable. You might also have GnuPG 2 available (as gpg2, otherwise install using apt-get update && apt-get upgrade gnupg2). GnuPG 2.1 would require adding the experimental repositories (which might change in future, I'd guess for Debian 9). You can look up which GnuPG 2 version is available in which repository in Debian's package tracker.
If you're using a live CD, be aware the entropy pool is reinitialized each time you're booting it. It might take slightly longer until the kernel decides having enough entropy for GnuPG, and key generation might take a little bit longer than usual (just longer, not less secure).
