46

What are the critical files I need to backup from GPG? I guess my private key would qualify of course, but what else?

Improve this question
0

6 Answers 6

Reset to default
46

The most critical are your secret/private keys:

gpg --export-secret-keys > secret-backup.gpg

secret-backup.gpg is then the file to keep safe.

Otherwise the ~/.gnupg/ directory contain all private and public keys(secring.gpg and pubring.gpg respectively) as well as configuration and trustdb which could be convenient to have stored.

Improve this answer
4
  • 2
    If a public key was lost, would the private key be useless?
    – Buttons840
    May 4, 2019 at 15:49
  • 1
    @Buttons840 The public key is a subset of the private key so you should be able to extract the public key from the private.
    – hultqvist
    May 4, 2019 at 18:21
  • 2
    Recent versions of GnuPG do not have pubring.gpg, but pubring.kbx and private keys are in a separate directory.
    – jarno
    May 3, 2020 at 6:11
  • Use gpg --import ~/secret-backup.gpg to restore the exported private keys.
    – 030
    Jul 30, 2021 at 14:27
14

There is nothing special. Let's assume your@id.here is your ID.:

Export keys and ownertrust:

gpg --export --armor your@id.here > your@id.here.pub.asc
gpg --export-secret-keys --armor your@id.here > your@id.here.priv.asc
gpg --export-secret-subkeys --armor your@id.here > your@id.here.sub_priv.asc
gpg --export-ownertrust > ownertrust.txt

Import keys and ownertrust:

gpg --import your@id.here.pub.asc
gpg --import your@id.here.priv.asc
gpg --import your@id.here.sub_priv.asc
gpg --import-ownertrust ownertrust.txt

Ultimately trust the imported key:

gpg --edit-key your@id.here
gpg> trust
Your decision? 5 (Ultimate trust)
Improve this answer
13

The easiest way would be to grab the entire GnuPG directory - usually ~/.gnupg/, it contains all private keys you have, as well as the public keyring and other useful data (trustdb, etc.)

Improve this answer
3
  • 1
    Isn't it also the safest way? Because the private keys are still encrypted.
    – tuxayo
    May 25, 2020 at 19:06
  • I have some weird files in my directory that does not want to be copied over scp
    – vidstige
    May 6, 2021 at 9:33
  • Don't copy them. They're sockets, not files.
    – user1686
    May 6, 2021 at 9:35
6

In addition to @serghei's answer, check the documentation of gnupg. It says that you should backup:

  • ~/.gnupg/gpg.conf (standard configuration file)
  • ~/.gnupg/pubring.gpg (legacy public keyring)
  • ~/.gnupg/pubring.kbx (new public keyring using keybox format)
  • ~/.gnupg/openpgp-revocs.d/ (revocation certificates)

It suggests also to backup the ownertrust

gpg --export-ownertrust > otrust.txt

Of course, you should backup your secret keys as well. If I understand correctly, the quickest way would be using tar to backup the whole ~/.gnupg except revocation certificates ~/.gnupg/openpgp-revocs.d/. You may consider to print revocation certificates as a QR code (qrencode) or instead, print out secret keys with the utility paperkey (see reference). Remember that if you keep your private keys and revocation certificates in one device, an attacker can revoke your public key and issue a new one claiming to be you.

Reference: An Advanced Introduction to GnuPG, Neal H. Walfiel section 6.3.8 (creating a backup).

Improve this answer
3
  • Why do we have to backup the public keyring? Aren't the public keys part of the secret keys? So exporting the secret keys + owner trust should be enough
    – JellyFilledNuts
    Oct 13, 2021 at 19:22
  • 1
    @JellyFilledNuts It may contain other people's public key, thus not part of the secret ones you own. See the documentation. In that perspective, it's not dramatic to lose them, just not very handy.
    – Firmin Martin
    Oct 13, 2021 at 20:02
  • 1
    I see, that makes sense. Thanks. I did not think about that aspect because so far I'm using GPG only for signing commits and encrypting stuff
    – JellyFilledNuts
    Oct 13, 2021 at 21:33
2

You definitely want to backup your private key and the revocation file you created.

Improve this answer
2
  • where is the "revocation certificate" ?
    – jldupont
    Nov 18, 2009 at 22:07
  • You need to create it (if you didn't already). It is used to revoke your key if you loose your private key.
    – PEra
    Nov 24, 2009 at 18:17
0

You may also want to back up any keys you've signed or ones you don't feel like re-downloading off the key servers.

At a minimum, all you need is your complete key.

Improve this answer
1
  • ...and any revocation certificates you created.
    – Broam
    Nov 18, 2009 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.