Daily use of GnuPG (2024)

Choosing a key size

Selecting a key size depends on the key.In OpenPGP, a public/private keypair usually has multiple keys.At the least it has a master signing key, and it probably has one ormore additional subkeys for encryption.Using default key generation parameters with GnuPG, the masterkey will be a DSA key, and the subkeys will be ElGamal keys.

DSA allows a key size up to 1024 bits.This is not especially good given today's factoring technology, butthat is what the standard specifies.Without question, you should use 1024 bit DSA keys.

ElGamal keys, on the other hand, may be of any size.Since GnuPG is a hybrid public-key system, the public key is usedto encrypt a 128-bit session key, and the private key is used todecrypt it.Key size nevertheless affects encryption and decryption speedsince the cost of these algorithms is exponential in the size ofthe key.Larger keys also take more time to generate and take more spaceto store.Ultimately, there are diminishing returns on the extra securitya large key provides you.After all, if the key is large enough to resist a brute-forceattack, an eavesdropper will merely switch to some other method forobtaining your plaintext data.Examples of other methods include robbing your home or officeand mugging you.1024 bits is thus the recommended key size.If you genuinely need a larger key size then you probably alreadyknow this and should be consulting an expert in data security.

Protecting your private key

Protecting your private key is the most important job you have touse GnuPG correctly.If someone obtains your private key, then all data encrypted tothe private key can be decrypted and signatures can be made in your name.If you lose your private key, then you will no longer be able to decrypt documents encrypted to you in the future or in the past,and you will not be able to make signatures.Losing sole possession of your private key is catastrophic.

Regardless of how you use GnuPG you should store the publickey's revocation certificate and a backup of your private key on write-protected media in a safe place.For example, you could burn them on a CD-ROM and store them in yoursafe deposit box at the bank in a sealed envelope.Alternatively, you could store them on a floppy and hide it in yourhouse.Whatever you do, they should be put on media that is safe to storefor as long as you expect to keep the key, and you should storethem more carefully than the copy of your private key you use daily.

To help safeguard your key, GnuPG does not store your rawprivate key on disk.Instead it encrypts it using a symmetric encryption algorithm.That is why you need a passphrase to access the key.Thus there are two barriers an attacker must cross to access your privatekey: (1) he must actually acquire the key, and (2) he must get pastthe encryption.

Safely storing your private key is important, but there is a cost.Ideally, you would keep the private key on a removable, write-protected disksuch as a floppy disk, and you would use it on a single-user machine not connected to a network.This may be inconvenient or impossible for you to do.For example, you may not own your own machine and must use a computer at work or school, or it may mean you have to physically disconnectyour computer from your cable modem every time you want to use GnuPG

This does not mean you cannot or should not use GnuPG.It means only that you have decided that the data you are protecting isimportant enough to encrypt but not so important as to take extrasteps to make the first barrier stronger.It is your choice.

A good passphrase is absolutely critical when using GnuPG.Any attacker who gains access to your private key must bypass the encryption on the private key.Instead of brute-force guessing the key, an attacker will almostcertainly instead try to guess the passphrase.

The motivation for trying passphrases is that most people choosea passphrase that is easier to guess than a random 128-bit key.If the passphrase is a word, it is much cheaper to try all thewords in the dictionaries of the world's languages.Even if the word is permuted, e.g., k3wldood, it is still easierto try dictionary words with a catalog of permutations.The same problem applies to quotations.In general, passphrases based on natural-language utterancesare poor passphrases since there is little randomness and lotsof redundancy in natural language.You should avoid natural language passphrases if you can.

A good passphrase is one that you can remember but is hard forsomeone to guess.It should include characters from the whole range of printable characterson your keyboard.This includes uppercase alphabetics characters, numbers, and specialcharacters such as } and |.Be creative and spend a little time considering your passphrase; agood choice is important to ensure your privacy.

Selecting expiration dates and using subkeys

By default, a DSA master signing key and an ElGamal encryption subkey are generated when you create a new keypair.This is convenient, because the roles of the two keys are different,and you may therefore want the keys to have different lifetimes.The master signing key is used to make digital signatures, and italso collects the signatures of others who have confirmed youridentity.The encryption key is used only for decrypting encrypted documentssent to you.Typically, a digital signature has a long lifetime, e.g., forever, andyou also do not want to lose the signatures on your key that you workedhard to collect.On the other hand, the encryption subkey may be changed periodicallyfor extra security, since if an encryption key is broken, theattacker can read all documents encrypted to that key both in thefuture and from the past.

It is almost always the case that you will not want the masterkey to expire.There are two reasons why you may choose an expiration date.First, you may intend for the key to have a limited lifetime.For example, it is being used for an event such as a political campaignand will no longer be useful after the campaign is over.Another reason is that if you lose control of the key and do not have arevocation certificate with which to revoke the key, having an expirationdate on the master key ensures that the key will eventually fall intodisuse.

Changing encryption subkeys is straightforward but canbe inconvenient.If you generate a new keypair with an expiration date on thesubkey, that subkey will eventually expire.Shortly before the expiration you will add a new subkey andpublish your updated public key.Once the subkey expires, those who wish to correspond with youmust find your updated key since they will no longer be ableto encrypt to the expired key.This may be inconvenient depending on how you distribute the key.Fortunately, however, no extra signatures are necessary sincethe new subkey will have been signed with your master signingkey, which presumably has already been validated by yourcorrespondents.

The inconvenience may or may not be worth the extra security.Just as you can, an attacker can still read all documents encrypted toan expired subkey.Changing subkeys only protects future documents.In order to read documents encrypted to the new subkey, theattacker would need to mount a new attack using whatevertechniques he used against you the first time.

Finally, it only makes sense to have one valid encryption subkey on akeyring.There is no additional security gained by having two or more active subkeys.There may of course be any number of expired keys on a keyringso that documents encrypted in the past may still be decrypted,but only one subkey needs to be active at any given time.

Managing your web of trust

As with protecting your private key, managing your web of trust isanother aspect of using GnuPG that requires balancing security againstease of use.If you are using GnuPG to protect against casual eavesdropping andforgeries then you can afford to be relatively trusting of otherpeople's signatures.On the other hand, if you are concerned that there may be a determinedattacker interested in invading your privacy, thenyou should be much less trusting of other signatures and spend more time personally verifying signatures.

Regardless of your own security needs, through, you should always be careful when signing other keys.It is selfish to sign a key with just enough confidence in the key'svalidity to satisfy your own security needs.Others, with more stringent security needs, may want to depend on your signature.If they cannot depend on you then that weakens the web of trustand makes it more difficult for all GnuPG users to communicate.Use the same care in signing keys that you would like others to use whenyou depend on their signatures.

In practice, managing your web of trust reduces to assigning trust to others and tuning the options --marginals-neededand --completes-needed.Any key you personally sign will be considered valid, but except for smallgroups, it will not be practical to personally sign the key of every personwith whom you communicate.You will therefore have to assign trust to others.

It is probably wise to be accurate when assigning trust and thenuse the options to tune how careful GnuPG is with key validation.As a concrete example, you may fully trust a few close friends thatyou know are careful with key signing and then marginallytrust all others on your keyring.From there, you may set --completes-needed to1 and --marginals-needed to2.If you are more concerned with security you might choose values of1 and 3 or 2and 3 respectively.If you are less concerned with privacy attacks and just want somereasonable confidence about validity, set the values to 1and 1.In general, higher numbers for these options imply that more peoplewould be needed to conspire against you in order to have a key validatedthat does not actually belong to the person whom you think it does.