I have OpenPGP key pairs for two of my email addresses. When I created them, I did not know that it was possible to just add another user id to the first key pair. Then I found out it is possible from the GnuPG documentation.

Is there a way to somehow merge my second key pair into a user id on my first one? I'm not sure if that even really makes sense. I was just wondering if that would be an option to only have one key pair in the future.

  • You mean only the identity or all the trust signatures associated? – Stefano Sanfilippo Jun 11 '15 at 20:03
  • In theory, I think the identity should be enough, as I did not actually use my second key really. I assume I could just delete my second key pair and just add that address as an identity to the first one. But I'm not sure if that's the right way. – flohei Jun 13 '15 at 5:47

Merging the user ID packets would be indeed possible -- but you'd have to create a new self-signatures afterwards for the user ID. You could use gpg-slit to cut apart the individual OpenPGP packets, and reconcatenate them using cat while putting the user ID packet at the right place (be aware: this requires deeper understanding of RFC 4880, OpenPGP).

But the use is rather limited: simply creating the same user ID has the exactly same effect, as all the certifications from others are created on a (primary public key, user ID string) tuple and thus will not be valid if the public key changes.

Decide which key should be the only one and create a new user ID. Sign that key with the superseded key, and revoke the superseded one instead (don't forget to upload both keys). Maybe notify those who certified the revoked key of that change, so they update your keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.