I would like to know if generating a PGP key with a number of bits higher than 4096 is possible and if so how?

  • 1
    ...and if so why ? :)
    – Shadok
    Nov 16 '11 at 15:04
  • 6
    @Shadok Because my key is longer than yours.
    – ott--
    Oct 4 '13 at 20:52

Yes, though some source code twiddling may be needed, you can generate 8,192 bit keys. In fact, I've seen some instances of 16,384 bit keys generated courtesy of the "Cyber Knights Templar (CKT)" builds of PGP "back in the day."

This blog post gives you an idea of where to look in the GnuPG source to bump that limit.

There are no different legal encumbrances to key sizes larger than 4,096 than there are to 4,096 bit keys. Just know that since there aren't a lot of keys larger than 4,096 bits floating around, the software of others might not work with them. I'm a bit curious to look into that now.


From the OpenPGP standard:

OpenPGP does not put limits on the size of public keys. However, larger keys are not necessarily better keys. Larger keys take more computation time to use, and this can quickly become impractical. Different OpenPGP implementations may also use different upper bounds for public key sizes, and so care should be taken when choosing sizes to maintain interoperability. As of 2007 most implementations have an upper bound of 4096 bits.

So this is "legal" but not really recommended if you want your key to be usable by other people who would like to send encrypted messages to you, and to verify messages you sign. (And if you do not want it, why bother having a public key at all ?)

GnuPG 1.4.11 appears to support RSA keys up to 4096 bits, and DSA keys up to 3072 bits. It will not go beyond.

  • Has someone already published some timesheets, what computational times it takes encrypt/decrypt messages with 4 and 8 kB keys? Or is this just a plea from the NSA not to use longer keys?
    – ott--
    Oct 4 '13 at 21:03
  • A simple openssl speed rsa on my laptop claims 40 signatures or decrypt operations per second (and per core), with 4096-bit RSA keys. Usual algorithms are cubic, so this scales to about 5 signatures or decrypt per second at 8192-bit RSA. It is quite useless anyway; known RSA breaking algorithms already have much trouble reaching 1024 bits, and will never do 2048 bits on this planet. And unknown algorithms are... unknown ! We cannot speculate on how they would behave with regards to key size (we don't even know if better RSA breaking algorithms can exist at all). Oct 4 '13 at 23:19
gpg --batch --gen-key <<EOF
Key-Type: RSA
Key-Length: 16384
Name-Real: NAME
Name-Comment: COMMENT
Name-Email: EMAIL
Passphrase: PASSWORD

However, no no sub keys are created. Do not sign and encrypt with the same key.

  • "However, no no sub keys are created." -crypt123 Note: One subkey can be simultaneously created using the commands: "Subkey-Type", "Subkey-Length" and "Subkey-Usage". Thanks for pointing me in the right direction, crypt123!
    – user30519
    Sep 7 '13 at 23:22

Here is a link to a bash script that increases the GnuPG key size limit beyond 4096 bits. The page also provides an ideal GnuPG .conf file. https://gist.github.com/anonymous/3d928a0bcbb3ed92c454 https://tinyurl.com/ultgpgset Please provide input and recommended changes.



Unattended Usage of GPG is the page of the official manual about gpg --batch --gen-key. This list of changes in GPG tells you:

What's New in 2.0.24


  • gpg: Cap RSA and Elgamal keysize at 4096 bit also for unattended key generation.

You have to use a GPG version older than 2.0.24. If you plan to use Gpg4win, download gpg4win-2.2.1.exe. It contains GPG 2.0.22.

If you want to use Key-Usage: without encrypt, sign, or auth you can do this. Just write:

Key-Usage: ,

The key will only be capable of certification.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.