What are the critical files I need to backup from GPG? I guess my private key would qualify of course, but what else?
Add a comment
|
6 Answers
The most critical are your secret/private keys:
gpg --export-secret-keys > secret-backup.gpg
secret-backup.gpg is then the file to keep safe.
Otherwise the ~/.gnupg/ directory contain all private and public keys(secring.gpg and pubring.gpg respectively) as well as configuration and trustdb which could be convenient to have stored.
-
3
-
2@Buttons840 The public key is a subset of the private key so you should be able to extract the public key from the private. May 4, 2019 at 18:21
-
2Recent versions of GnuPG do not have pubring.gpg, but pubring.kbx and private keys are in a separate directory.– jarnoMay 3, 2020 at 6:11
-
1Use
gpg --import ~/secret-backup.gpgto restore the exported private keys.– 030Jul 30, 2021 at 14:27
First of all, before we begin, [email protected] represents your GPG key ID. This could be your email address or the key ID.
Indeed, your private key is critical, but other files are also important.
1. Export keys and ownertrust:
These commands are intended to export your keys and trust level. Public and private keys are used for encryption/decryption, and the trust level determines how much you trust other keys in your keyring.
Run the following commands in your command line (Command Prompt for Windows, Terminal for macOS and Linux). Replace "[email protected]" with your GPG key ID:
gpg --export --armor [email protected] > [email protected]
gpg --export-secret-keys --armor [email protected] > [email protected]
gpg --export-secret-subkeys --armor [email protected] > [email protected]_priv.asc
gpg --export-ownertrust > ownertrust.txt
2. Import keys and ownertrust:
If you need to restore your keys and trust level (e.g., after reinstalling the system or on a new computer), use the following commands:
gpg --import [email protected]
gpg --import [email protected]
gpg --import y[email protected]_priv.asc
gpg --import-ownertrust ownertrust.txt
3. Ultimately trust the imported key:
This step is needed to set the ultimate trust level for your keys. Run the following command, then type trust, then 5 (which means "ultimate trust") and hit Enter:
gpg --edit-key [email protected]
gpg> trust
Your decision? 5
Note: If you're operating on Windows, you might need to install GPG4Win first. If you're on macOS, you may need to install GPG Suite.
Update 2023.07.21
An essential point I'd like to address is related to suggestions about backing up the entire ~/.gnupg/ directory. This practice might seem straightforward and quick, but it comes with its pitfalls.
Yes, the ~/.gnupg/ directory does contain all your private and public keys, as well as the trust database and other useful data. However, it also includes your key revocation certificates (~/.gnupg/openpgp-revocs.d/), which are not advisable to include in your backup. This is because if your backup gets stolen or lost, a malicious actor could revoke your keys, rendering them unusable.
Moreover, the ~/.gnupg/ directory may contain temporary files and other less critical data that you might not need during restoration, and it might unnecessarily increase the size of your backup.
On the other hand, exporting keys and trust level, as I explained above, allows for more controlled and secure data management. This approach minimizes risks and makes the process more reliable and predictable.
So, while copying the entire ~/.gnupg/ directory might seem like a quick solution, it may not be the best option in terms of data security and management.
The easiest way would be to grab the entire GnuPG directory - usually ~/.gnupg/, it contains all private keys you have, as well as the public keyring and other useful data (trustdb, etc.)
answered Nov 18, 2009 at 21:42
In addition to @serghei's answer, check the documentation of gnupg. It says that you should backup:
~/.gnupg/gpg.conf(standard configuration file)~/.gnupg/pubring.gpg(legacy public keyring)~/.gnupg/pubring.kbx(new public keyring using keybox format)~/.gnupg/openpgp-revocs.d/(revocation certificates)
It suggests also to backup the ownertrust
gpg --export-ownertrust > otrust.txt
Of course, you should backup your secret keys as well. If I understand correctly, the quickest way would be using tar to backup the whole ~/.gnupg except revocation certificates ~/.gnupg/openpgp-revocs.d/. You may consider to print revocation certificates as a QR code (qrencode) or instead, print out secret keys with the utility paperkey (see reference). Remember that if you keep your private keys and revocation certificates in one device, an attacker can revoke your public key and issue a new one claiming to be you.
Reference: An Advanced Introduction to GnuPG, Neal H. Walfiel section 6.3.8 (creating a backup).
-
Why do we have to backup the public keyring? Aren't the public keys part of the secret keys? So exporting the secret keys + owner trust should be enough Oct 13, 2021 at 19:22
-
1@JellyFilledNuts It may contain other people's public key, thus not part of the secret ones you own. See the documentation. In that perspective, it's not dramatic to lose them, just not very handy. Oct 13, 2021 at 20:02
-
1I see, that makes sense. Thanks. I did not think about that aspect because so far I'm using GPG only for signing commits and encrypting stuff Oct 13, 2021 at 21:33
You definitely want to backup your private key and the revocation file you created.
-
-
You need to create it (if you didn't already). It is used to revoke your key if you loose your private key.– PEraNov 24, 2009 at 18:17
You may also want to back up any keys you've signed or ones you don't feel like re-downloading off the key servers.
At a minimum, all you need is your complete key.
