Contents
How many OpenPGP keys should I make per identity?
In general, one key per identity should be fine. Several UIDs (for separate mail addresses.) Several subkeys (for different devices, so you can put some subkey on your mobile; if it gets lost, revoke only this) Less hassle maintaining your keys including moving to other computers, revocation certificates,
How are subkeys generated in GPG-edit-key?
Subkeys are generated by running gpg –edit-key [key-id] for the primary key, and then starting the subkey generation assistant with the addkey command (don’t forget to save afterwards).
Can a key have multiple identities on it?
Identities are signed and a key may have multiple identities on it. Thus, you could have one key with all the identities that you wish to lay claim to. Equally, you can create as many keys as you want to have disconnected identities It’s entirely a personal matter as to how many you feel will be appropriate and personally manageable.
When do you need more than one key?
You only need multiple keys if you want to have multiple disconnected identities. Identities are signed and a key may have multiple identities on it. Thus, you could have one key with all the identities that you wish to lay claim to.
What are the advantages of using subkeys in OpenPGP?
Another advantage to the use of the subkeys is that in the event of loss or theft of the secret keys of the subkeys, you only need to revoke the subkey without having to revoke the master key (the one that allows to certify other keys). Let’s start by creating the master key, the one that will hold our identity.
Which is the best tool to manage OpenPGP keys?
Seahorse is a GUI tool for creating and managing OpenPGP keys, securely storing passwords, and creating and managing SSH certificates. It uses GPG as the back-end OpenPGP implementation. Launch Seahorse. It should be installed by default. Select GnuPG keys. Select the + sign to create a new key. Select PGP Key.
How do I create a new GnuPG key?
Select GnuPG keys. Select the + sign to create a new key. Select PGP Key. Enter your email and the name you would like to be associated with the key. This doesn’t need to be your real name. Select advanced options. Encryption type should be RSA. Key strength should be 3072. Expiration date should be within less then two years.