Search code examples
securityencryptionpgpopenpgp

Which key to export for PGP encryption and signing on different devices?

I recently created a PGP keypair using GnuPG keychain tool on mac. I can see that it automatically creates a master key and an encryption sub key. Now I want to use a key for encryption and signing on my smartphone as well.

  1. So what is the best practice for it?
  2. Does one create new subkeys for smartphone for this purpose or use the same which were generated?
  3. Can you please provide an example for same?
Solution

  • Create an additional signing subkey (gpg --edit-key [key-id], addkey) and then only export the subkeys. If the keys on your smartphone get compromised, you only need to exchange the subkeys, and do not have to distribute your key again.

    You could create an additional signing subkey for each device. For encryption subkeys this is a little bit more complicated, as the OpenPGP protocol does not know a way to bind keys to certain usage or devices; the other party's client will usually just select the newest usable encryption subkey, so you'll have to use the same encryption subkey on all devices.