11

I have generated keys using GPG, by executing the following command

gpg --gen-key

Now I need to export the key pair to a file; i.e., private and public keys to private.pgp and public.pgp, respectively.  How do I do it?

20

Export Public Key

This command will export an ascii armored version of the public key:

gpg --output public.pgp --armor --export username@email

Export Secret Key

This command will export an ascii armored version of the secret key:

gpg --output private.pgp --armor --export-secret-key username@email


Security Concerns, Backup, and Storage

A PGP public key contains information about one's email address. This is generally acceptable since the public key is used to encrypt email to your address. However, in some cases, this is undesirable.

For most use cases, the secret key need not be exported and should not distributed. If the purpose is to create a backup key, you should use the backup option:

gpg --output backupkeys.pgp --armor --export --export-options export-backup user@email

This will export all necessary information to restore the secrets keys including the trust database information. Make sure you store any backup secret keys off the computing platform and in a secure physical location.

If this key is important to you, I recommend printing out the key on paper using paperkey. And placing the paper key in a fireproof/waterproof safe.

Public Key Servers

In general, it's not advisable to post personal public keys to key servers. There is no method of removing a key once it's posted and there is no method of ensuring that the key on the server was placed there by the supposed owner of the key.

It is much better to place your public key on a website that you own or control. Some people recommend keybase.io for distribution. However, that method tracks participation in various social and technical communities which may not be desirable for some use cases.

For the technically adept, I personally recommend trying out the webkey domain level key discovery service.

  • Is the exported key (second command) encrypted or do I need to encrypt it by myself before storing it on a.g. a USB drive? – Julian Feb 18 at 10:53
  • 1
    @Julian ... The exported secret key has the same protection as the secret key that was exported. If there was a passphrase, the passphrase is required to import the secret key. – RubberStamp Feb 18 at 12:55
  • 1
    I made a backup using the above method, but foolishly forgot to test it. Unless I'm missing something, I can't seem to recover my public key from the backup method specified (--export-options export-backup, etc). Am I missing something, or did I misunderstand the kind of backup it was making? – OMGtechy Aug 5 at 0:46
0
  • List the keys you have: gpg --list-secret-keys
  • Export the key: gpg --export-secret-key name > ~/my-key.asc
  • Copy it on another machine;
  • Import the key: gpg --import my-key.asc

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.