Give keys/subkeys in gpg names

Question

I am learning how to use gpg, and I would like create multiple keys for different purposes, for example one to encrypting my emails, anther for connecting to ssh, yet another for pass password store. I can see this quickly getting out of hands where I loose track of which key did I use for ssh etc.

So my question is how can I stay organized? Is there a way to append keys or subkeys with names or some tagging system? Or I am thinking about this the wrong way and I shouldn't look at gpg itself to organize my keys?

I know that this question is kind of open ended and possibly opinionated but I'm just not sure what security practices are recommended here.

Answer 1

GPG (sub)keys used for SSH authentication must have usage A (Authentication) and in practice that usage isn't used for anything else, so selectively setting that could be enough to identify your SSH key(s). In older versions it was hard to set/change or even see the usage flags, but modern GPG it is better: see
How are the GPG usage flags defined in the key details listing?
https://security.stackexchange.com/questions/31614/how-to-change-subkey-usage-of-a-pgp-key
https://superuser.com/questions/833875/how-do-i-display-the-usage-flags-for-my-encryption-keys-in-a-less-hackish-way
https://security.stackexchange.com/questions/206072/how-do-i-interpret-output-that-produces-gpg-listing-keys
but be cautious of the dates of each.

If you use gpg --full-gen-key it allows you to enter 'Real name', 'Email address', and 'Comment' all of which go in the userid record, which is shown when you list or otherwise look at keys. Obviously you can put any information you want in comment; less obviously you can do so in the other fields. PGP was originally designed to be used for email, so it was intended that keys be associated with people, or email addresseses which appear stable to outsiders but are actually shared and/or transferred between people such as a business department or 'listserv', but this is only an intent -- programs like GPG can process any correctly formatted data whether or not it actually was received or will be sent as email.

Note however the userid info is included in the publickey, and can be seen by anyone your publickey is distributed to -- which may be many if you use common or default methods of distribution like a keyserver. Labelling a key "[email protected] (use this key for github)" and giving that key to github to verify your commits is probably a good idea. Labelling a key "(remember this is not the right key for my child pornography files)" is probably a bad idea. Also note userid info is only at the masterkey level not subkey, so it doesn't easily help distinguish subkeys -- but then most PGP programs, including GPG, usually operate only on the masterkey and don't make it very easy to select or even identify subkeys for most operations.