I plan to create a 4096 bit RSA&RSA key pair:

gpg --gen-key --personal-digest-preferences SHA512 --cert-digest-algo SHA512

Is there any difference in generated key quality between versions 1.4 (classic), 2.0 (stable), and 2.1 (modern)?

Background: I consider creating the key on a cleanly booted Debian stable live system, and that comes with GnuPG version 1.4.12.


Different versions of GnuPG

All versions of GnuPG mentioned are (as of 2015) still maintained and updated. Differences are mainly of architectural kind; classic (1.4) is proposed to be used within for server and embedded platforms (from man gpg2), while stable and modern are recommended for desktop use (having more dependencies, but being more modular and flexible). GnuPG 2.1 heavily relies on the gpg-agent for all operations requiring the secret key, which delegates the most risky operations to a much smaller piece of software with less exposure to vulnerabilities.

Keys created with all of those versions are equally secure, and can be arbitrarily interchanged with the other versions (by importing/exporting). There are no known vulnerabilities regarding key generation within all those versions.

GnuPG 1.4.12 (Seemingly) Outdated

Also, while 1.4.12 is seemingly outdated as 1.4.14 resolving critical issues is published, Debian backports relevant security patches to older versions to keep the packages stable. You might also have GnuPG 2 available (as gpg2, otherwise install using apt-get update && apt-get upgrade gnupg2). GnuPG 2.1 would require adding the experimental repositories (which might change in future, I'd guess for Debian 9). You can look up which GnuPG 2 version is available in which repository in Debian's package tracker.

Entropy with Live CDs

If you're using a live CD, be aware the entropy pool is reinitialized each time you're booting it. It might take slightly longer until the kernel decides having enough entropy for GnuPG, and key generation might take a little bit longer than usual (just longer, not less secure).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.