I would like to know if generating a PGP key with a number of bits higher than 4096 is possible and if so how?
Yes, though some source code twiddling may be needed, you can generate 8,192 bit keys. In fact, I've seen some instances of 16,384 bit keys generated courtesy of the "Cyber Knights Templar (CKT)" builds of PGP "back in the day."
This blog post gives you an idea of where to look in the GnuPG source to bump that limit.
There are no different legal encumbrances to key sizes larger than 4,096 than there are to 4,096 bit keys. Just know that since there aren't a lot of keys larger than 4,096 bits floating around, the software of others might not work with them. I'm a bit curious to look into that now.
From the OpenPGP standard:
OpenPGP does not put limits on the size of public keys. However, larger keys are not necessarily better keys. Larger keys take more computation time to use, and this can quickly become impractical. Different OpenPGP implementations may also use different upper bounds for public key sizes, and so care should be taken when choosing sizes to maintain interoperability. As of 2007 most implementations have an upper bound of 4096 bits.
So this is "legal" but not really recommended if you want your key to be usable by other people who would like to send encrypted messages to you, and to verify messages you sign. (And if you do not want it, why bother having a public key at all ?)
GnuPG 1.4.11 appears to support RSA keys up to 4096 bits, and DSA keys up to 3072 bits. It will not go beyond.
Here is a link to a bash script that increases the GnuPG key size limit beyond 4096 bits. The page also provides an ideal GnuPG .conf file. https://gist.github.com/anonymous/3d928a0bcbb3ed92c454 https://tinyurl.com/ultgpgset Please provide input and recommended changes.
What's New in 2.0.24
- gpg: Cap RSA and Elgamal keysize at 4096 bit also for unattended key generation.
You have to use a GPG version older than 2.0.24. If you plan to use Gpg4win, download gpg4win-2.2.1.exe. It contains GPG 2.0.22.
If you want to use
auth you can do this. Just write:
The key will only be capable of certification.