Home / server / Questions / 86048
Accepted
jldupont
Asked: 2009-11-19 12:46:24 +0800 CST

How to backup GPG?

  • 772

What are the critical files I need to backup from GPG? I guess my private key would qualify of course, but what else?

backup

6 Answers

  1. Best Answer

    The most critical are your secret/private keys:

    gpg --export-secret-keys > secret-backup.gpg

    secret-backup.gpg is then the file to keep safe.

    Otherwise the ~/.gnupg/ directory contain all private and public keys(secring.gpg and pubring.gpg respectively) as well as configuration and trustdb which could be convenient to have stored.

    • 47

  2. There is nothing special. Let's assume [email protected] is your ID.:

    Export keys and ownertrust:

    gpg --export --armor [email protected] > [email protected]
gpg --export-secret-keys --armor [email protected] > [email protected]
gpg --export-secret-subkeys --armor [email protected] > [email protected]_priv.asc
gpg --export-ownertrust > ownertrust.txt

    Import keys and ownertrust:

    gpg --import [email protected]
gpg --import [email protected]
gpg --import [email protected]_priv.asc
gpg --import-ownertrust ownertrust.txt

    Ultimately trust the imported key:

    gpg --edit-key [email protected]
gpg> trust
Your decision? 5 (Ultimate trust)
    • 15

  3. The easiest way would be to grab the entire GnuPG directory - usually ~/.gnupg/, it contains all private keys you have, as well as the public keyring and other useful data (trustdb, etc.)

    • 13

  4. In addition to @serghei's answer, check the documentation of gnupg. It says that you should backup:

    • ~/.gnupg/gpg.conf (standard configuration file)
    • ~/.gnupg/pubring.gpg (legacy public keyring)
    • ~/.gnupg/pubring.kbx (new public keyring using keybox format)
    • ~/.gnupg/openpgp-revocs.d/ (revocation certificates)

    It suggests also to backup the ownertrust

    gpg --export-ownertrust > otrust.txt

    Of course, you should backup your secret keys as well. If I understand correctly, the quickest way would be using tar to backup the whole ~/.gnupg except revocation certificates ~/.gnupg/openpgp-revocs.d/. You may consider to print revocation certificates as a QR code (qrencode) or instead, print out secret keys with the utility paperkey (see reference). Remember that if you keep your private keys and revocation certificates in one device, an attacker can revoke your public key and issue a new one claiming to be you.

    Reference: An Advanced Introduction to GnuPG, Neal H. Walfiel section 6.3.8 (creating a backup).

    • 7

  5. You definitely want to backup your private key and the revocation file you created.

    • 2

  6. You may also want to back up any keys you've signed or ones you don't feel like re-downloading off the key servers.

    At a minimum, all you need is your complete key.

    • 0