Creating a new GPG key

I wanted to renew my GPG key for some time and after reading the latest news, I finally have generated a new key today.

pub   4096R/6AA15948 2009-05-10
      Key fingerprint = 7A33 ECAA 188B 96F2 7C91  7288 B346 4F89 6AA1 5948
uid                  Ana Beatriz Guerrero López <ana@ekaia.org>
uid                  Ana Beatriz Guerrero López <ana@debian.org>
sub   4096R/2497B8B2 2009-05-10


Since I tend to forget this stuff, I am blogging all the steps I have followed.
Long and verbose post follows…

Update .gnupg/gpg.conf

Add at the end of the file:

personal-digest-preferences SHA256
cert-digest-algo SHA256
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed

Create key

Update September’2009: If you are using gnupg 1.4.0 or higher, the options have changed. You can select directly the option (1) RSA and RSA (default), then you also create a subkey for encryption at the same time you create your new key and you can skip the “Add subkey for encryption” step.

ana@pryan:~$ gpg --gen-key
 ...        

Please select what kind of key you want:
   (1) DSA and Elgamal (default)        
   (2) DSA (sign only)                  
   (5) RSA (sign only)                  
Your selection? 5                       
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096           
Requested keysize is 4096 bits                  
Please specify how long the key should be valid.
         0 = key does not expire
        = key expires in n days
      w = key expires in n weeks
      m = key expires in n months
      y = key expires in n years
Key is valid for? (0)
Key does not expire at all
Is this correct? (y/N) y

 ...

Real name: Ana Beatriz Guerrero López
Email address: ana@ekaia.org
Comment:
You are using the `utf-8' character set.
You selected this USER-ID:
    "Ana Beatriz Guerrero López <ana@ekaia.org>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.
 
 ... 

gpg: key 6AA15948 marked as ultimately trusted
public and secret key created and signed.

gpg: checking the trustdb

 ...

gpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model
gpg: depth: 0  valid:   3  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 3u
pub   4096R/6AA15948 2009-05-10
      Key fingerprint = 7A33 ECAA 188B 96F2 7C91  7288 B346 4F89 6AA1 5948
uid                  Ana Beatriz Guerrero López <ana@ekaia.org>

Note that this key cannot be used for encryption.  You may want to use
the command "--edit-key" to generate a subkey for this purpose.

Add other UID

ana@pryan:~$ gpg --edit-key 0x6AA15948            
 ...                             
command> adduid
Real name: Ana Beatriz Guerrero López
Email address: ana@debian.org
Comment:
You are using the `utf-8' character set.
You selected this USER-ID:
    "Ana Beatriz Guerrero López <ana@debian.org>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o

You need a passphrase to unlock the secret key for
user: "Ana Beatriz Guerrero López <ana@ekaia.org>"
4096-bit RSA key, ID 6AA15948, created 2009-05-10


pub  4096R/6AA15948  created: 2009-05-10  expires: never       usage: SC
                     trust: ultimate      validity: ultimate
[ultimate] (1)  Ana Beatriz Guerrero López <ana@ekaia.org>
[ unknown] (2). Ana Beatriz Guerrero López <ana@debian.org>

Command> save

Change preferences

ana@pryan:~$ gpg --edit-key 0x6AA15948
 ...
Command> showpref
[ultimate] (1). Ana Beatriz Guerrero López <ana@debian.org>
     Cipher: AES256, AES192, AES, CAST5, 3DES
     Digest: SHA1, SHA256, RIPEMD160
     Compression: ZLIB, BZIP2, ZIP, Uncompressed
     Features: MDC, Keyserver no-modify
[ultimate] (2)  Ana Beatriz Guerrero López <ana@ekaia.org>
     Cipher: AES256, AES192, AES, CAST5, 3DES
     Digest: SHA1, SHA256, RIPEMD160
     Compression: ZLIB, BZIP2, ZIP, Uncompressed
     Features: MDC, Keyserver no-modify

Command>  setpref SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
Set preference list to:
     Cipher: AES256, AES192, AES, CAST5, 3DES
     Digest: SHA512, SHA384, SHA256, SHA224, SHA1
     Compression: ZLIB, BZIP2, ZIP, Uncompressed
     Features: MDC, Keyserver no-modify
Really update the preferences? (y/N) y
gpg: WARNING: no user ID has been marked as primary.  This command may
              cause a different user ID to become the assumed primary.

You need a passphrase to unlock the secret key for
user: "Ana Beatriz Guerrero López <ana@debian.org>"
4096-bit RSA key, ID 6AA15948, created 2009-05-10


pub  4096R/6AA15948  created: 2009-05-10  expires: never       usage: SC
                     trust: ultimate      validity: ultimate
[ultimate] (1)  Ana Beatriz Guerrero López <ana@debian.org>
[ultimate] (2). Ana Beatriz Guerrero López <ana@ekaia.org>

Command> showpref
[ultimate] (1)  Ana Beatriz Guerrero López <ana@debian.org>
     Cipher: AES256, AES192, AES, CAST5, 3DES
     Digest: SHA512, SHA384, SHA256, SHA224, SHA1
     Compression: ZLIB, BZIP2, ZIP, Uncompressed
     Features: MDC, Keyserver no-modify
[ultimate] (2). Ana Beatriz Guerrero López <ana@ekaia.org>
     Cipher: AES256, AES192, AES, CAST5, 3DES
     Digest: SHA512, SHA384, SHA256, SHA224, SHA1
     Compression: ZLIB, BZIP2, ZIP, Uncompressed
     Features: MDC, Keyserver no-modify

Command> save

Set primary UID

ana@pryan:~$ gpg --edit-key 0x6AA15948
  ...
Command> uid 1

pub  4096R/6AA15948  created: 2009-05-10  expires: never       usage: SC
                     trust: ultimate      validity: ultimate
[ultimate] (1)* Ana Beatriz Guerrero López <ana@ekaia.org>
[ultimate] (2)  Ana Beatriz Guerrero López <ana@debian.org>

Command> primary

You need a passphrase to unlock the secret key for
user: "Ana Beatriz Guerrero López <ana@ekaia.org>"
4096-bit RSA key, ID 6AA15948, created 2009-05-10


pub  4096R/6AA15948  created: 2009-05-10  expires: never       usage: SC
                     trust: ultimate      validity: ultimate
[ultimate] (1)* Ana Beatriz Guerrero López <ana@ekaia.org>
[ultimate] (2)  Ana Beatriz Guerrero López <ana@debian.org>

Command> save

Add subkey for encryption

ana@pryan:~$ gpg --edit-key 0x6AA15948
  ...
Command> addkey
Key is protected.

You need a passphrase to unlock the secret key for
user: "Ana Beatriz Guerrero López <ana@ekaia.org>"
4096-bit RSA key, ID 6AA15948, created 2009-05-10

Please select what kind of key you want:
   (2) DSA (sign only)
   (4) Elgamal (encrypt only)
   (5) RSA (sign only)
   (6) RSA (encrypt only)
Your selection? 6
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits
Please specify how long the key should be valid.
         0 = key does not expire
        = key expires in n days
      w = key expires in n weeks
      m = key expires in n months
      y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y
Really create? (y/N) y

 ...

pub  4096R/6AA15948  created: 2009-05-10  expires: never       usage: SC
                     trust: ultimate      validity: ultimate
sub  4096R/2497B8B2  created: 2009-05-10  expires: never       usage: E
[ultimate] (1). Ana Beatriz Guerrero López <ana@ekaia.org>
[ultimate] (2)  Ana Beatriz Guerrero López <ana@debian.org>

Command> save

Sign my new key with my old key


ana@pryan:~$ gpg --default-key E8C43461 --sign-key 6AA15948

pub  4096R/6AA15948  created: 2009-05-10  expires: never       usage: SC
                     trust: ultimate      validity: ultimate
sub  4096R/2497B8B2  created: 2009-05-10  expires: never       usage: E
[ultimate] (1). Ana Beatriz Guerrero López <ana@ekaia.org>
[ultimate] (2)  Ana Beatriz Guerrero López <ana@debian.org>

Really sign all user IDs? (y/N) y

pub  4096R/6AA15948  created: 2009-05-10  expires: never       usage: SC
                     trust: ultimate      validity: ultimate
 Primary key fingerprint: 7A33 ECAA 188B 96F2 7C91  7288 B346 4F89 6AA1 5948

     Ana Beatriz Guerrero López <ana@ekaia.org>
     Ana Beatriz Guerrero López <ana@debian.org>

Are you sure that you want to sign this key with your
key "Ana Beatriz Guerrero López <ana@ekaia.org>" (E8C43461)

Really sign? (y/N) y

You need a passphrase to unlock the secret key for
user: "Ana Beatriz Guerrero López <ana@ekaia.org>"
1024-bit DSA key, ID E8C43461, created 2004-12-06
 ...

Send new key to key server

gpg --keyserver pgp.mit.edu --send-key 6AA15948

37 thoughts on “Creating a new GPG key

  1. transacid

    Hmm that may sound like a stupid question to you but why do you generate 2 keys, one for signing and one for encryption? Maybe i miss something their. Please enlighten me.

  2. Jonathan Thomas

    The RSA key can’t do both, so two keys are required.

    Anyway, thanks for this guide! It’s the best one I’ve found so far. :)

  3. Gregory Colpart

    It could be useful to add “Generate revocation certificate” section with ‘gpg –gen-revoke’, because it’s important to generate a revocation certificate immediatly after key creation. ;-)

  4. Daniel Kahn Gillmor

    Ana, thanks for documenting the steps you took, this is really great.

    For folks who might be following these steps, i just updated my weblog post about SHA-1 and OpenPGP (thanks to a suggestion from David Crick) to suggest adding a third line to ~/.gnupg/gpg.conf before key generation, which should make it so that you the digest preferences are set up properly in the first place (this would make it so that you don’t need to do the “Change Preferences” step).

    the additional line would be:

    default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed

  5. Pingback: A new GPG key | Delodder.be

  6. Jakob Petsovits

    This and Dakon’s KDE modification is a great resource. Maybe I’ll try it out for myself sometime soon.

    Still, I think you people are all crazy. How is any non-technical person supposed to not only figure out how to do the stuff in here, but even figure out *what* needs to be done in the first place (= titles in your post) and *why* all of this needs to be done?

    It’s pretty much impossible to understand all of this without having at least attended a university course in cryptography. Heck, I did attend one, and I still wouldn’t figure out this thing by myself.

    Imho, GPG is a great thing in theory, but if there are no significant improvements in getting people to understand this thing, it’ll always stay a niche technology. Which I think is really unfortunate, because secure communication should not require this level of expertise, not anywhere near it.

  7. Pingback: Mike Perdide » GPG : I can haz identity

  8. Henrique

    @Jakob Petsovits:

    Actually, no, we are not crazy. We just need gpg enough that we actually learn how it works and don’t wait for upstream to change the defaults :-)

    A regular user without crypto experience can just use the gpg defaults, they are quite good enough and are not going to be the limiting factor for this user’s security. His inexperience when dealing with information security, OTOH, likely will. And there is nothing software can do to fix THAT.

  9. Stemp

    I’m ashamed to say I forgot to tell you how much your post was helpfull.
    Everybody was talking about new gpg keys but no one, except you, did a clear post about doing it for dumbs like me.
    Thanks a lot.

  10. bjoernb

    Hej Ana,

    just a short notice. You should link to your new key on your website. It still points to your old key.

    Best wishes,
    bjoernb.

  11. Ben

    I only needed part of what you have here but it was very useful. Thanks for posting in such a detailed manner.

  12. Pingback: ghostbar » FYI: new gpg key 7C4DF50D

  13. Pingback: Christine Spang (spang) 's status on Friday, 17-Jul-09 10:18:15 UTC - Identi.ca

  14. Bill Thompson

    Why a 4096b key? I have had interoperability problems with keys that size in the past so usually do not use more than 2048b. Is there an RSA 2048b compromise you are aware of or are you just being through?

  15. mirabilos

    Of course, RSA can do both, but the FSF and GnuPG
    won’t let you. Use –expert too, choose 7, then select
    all four of S+C+E+A key purposes.

    In batch mode, you can generate even longer keys,
    like pgp-2.6.3ia could.

  16. Pingback: Kartar.Net » Creating a new GPG key and revoking the old one

  17. Charles Plessy

    Hello Ana,

    there were changes in GPG… What do you recommend: RSA sign only, or the new RSA and RSA default?

    gpg (GnuPG) 1.4.10; Copyright (C) 2008 Free Software Foundation, Inc.
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.

    Please select what kind of key you want:
    (1) RSA and RSA (default)
    (2) DSA and Elgamal
    (3) DSA (sign only)
    (4) RSA (sign only)

    Have a nice day !

  18. ana Post author

    @Charles Plessy:

    This is the new default since GNUPG 1.4.0.
    If you choose (1) you create also a subkey for encryption at the same time you create your new key and then you can skip the “Add subkey for encryption” step of my HOWTO.

  19. Pingback: Robert Escriva » Blog Archive » Joining the GPG Web of Trust (WoT)

  20. mirabilos

    > The RSA key can’t do both, so two keys are required.

    This is actually wrong. GnuPG cripples RSA so that it
    cannot do both by default, so that people use DSA, for
    former political (patent in the USA) reasons.

    Use –expert to see this:
    (7) RSA (set your own capabilities)

    Then make sure all four of S, C, E and A are set.

  21. Pingback: My New GPG Key « Short-Circuit Synapse

  22. T-Bone Steak

    @Bill: A 2048b key should be the norm today, and the reason for creating a 4096b key is to have it stay a bit longer. Imho, 2048b may already be in reach of the spooks, and you don’t want to run around getting your new key signed every few months, do you?

  23. Pingback: Changing/Renewing GPG key procedure? | blog.windfluechter.net

  24. Pingback: Com usar una clau GPG per a SSH | Ivan. Loves. Gazpacho.

  25. Pingback: Debconf11 – המשך הכנס « תוכנה חופשית בעברית

  26. tomasio

    Great blog entry, but could you explain why I have to “Sign my new key with my old key”? I revoked my old key before creating a new one, so isn’t it contraproductive to sign my new key with the old (revoked) key?

    buenas dias,

    tomasio

  27. Pingback: Privacy | Josh Lawrence

  28. Pingback: Compiling GnuPG 1.x on Linux for Windows – PCR's notepad

  29. Jonathan

    First, thanks Ana for a great blog post which is still a useful reference 4 years later!

    To respond to a point mirabilos raised in an earlier comment: by default gpg won’t let you create an RSA key for both signing and encrypting. You can override this using expert mode as pointed out. However, it appears there is a good reason for the restriction, at least in some locales. I attended a talk by Dr Matthew Sorell yesterday highlighting some interesting examples of PGP in legal cases. It turns out there is some UK legislation whereby folks are compelled to give a copy of private keys to the UK government if they are used for signatures. Apparently it was this legislation which encouraged Zimmerman to make PGP use separate signing and encryption keys originally. I’m afraid I don’t (yet) have a reference to the precise legislation, but I thought this would be useful information here non-the-less. Thanks

Comments are closed.