8

I would like to create a new GPG key. Going through a couple of thread it seems like the most popular scheme for maximum security is to have an offsite master (sign-only) key which provides a shell for a couple of daily-use subkeys.

As the master key could probably serve one a lifetime I was thinking about putting only my real name into it without any email address as they possibly will change anyway over the years as well as nobody shall send an email to the master key as well. Is this a good practice, should i put a comment like (master signing key) or my birthday/birthplace in it? What would you recommend?

user46023
  • 81
  • 1
  • 2
  • Related: [Best practices for GPG user ids](http://security.stackexchange.com/q/67259/12139) – unor Nov 16 '14 at 21:34

1 Answers1

7

Your primary key (which is the OpenPGP saying for what you called "master" key) is the entity all other subkeys and user IDs are bound to.

Having an Offline Primary Key

Going through a couple of thread it seems like the most popular scheme for maximum security is to have an offsite master (sign-only) key which provides a shell for a couple of daily-use subkeys.

Storing it offline can be reasonable to enhance it's security, as chances of getting hold of it in case your computer gets corrupted are lowered; it would have to be on your computer at the time being corrupted. I posted some more elaboration on offline keys in another answer.

Back to your questions:

Primary User ID Without Mail Address

I was thinking about putting only my real name into it without any email address as they possibly will change anyway over the years as well as nobody shall send an email to the master key as well.

This is preferred by some OpenPGP users, as it decouples the person (you) from something you own (your mail address). Mail addresses tend to change over time, but you will very likely stay the same person with the same name for a long time (name changes, possibly through marriages, are rather infrequent).

Like already mentioned above, your primary key actually will never have a user ID (mail address) included. Instead, usually the primary user ID will be printed next to it.

This is usually the first one created, but this can be also changed whenever you want – also for existing keys with a primary user ID containing a mail address. To do so, run gpg --edit-key [key-id]. list the user IDs, and select the one you want to make the primary by typing its number. The next list will print a star next to the user ID. primary will make the the primary user ID.

Further Details in the Primary User ID

Is this a good practice, should i put a comment like (master signing key) or my birthday/birthplace in it?

There are pros and cons to this. Your place and date of birth, together with your name, are usually sufficient to really uniquely identify you – depending on how common your first and family names are, there might be other persons with the same name, but very likely not the same place and date of birth. On the other hand, these might be enough to misuse your identity, and depending on your society might be considered very intimate details of your life. Remember you will not be able to undelete anything that found its way on the key servers! But also think about what you but in your social web profiles. If you're listed on some find-my-classmates-website, your age is listed on Stack Overflow and your friends post birthday congratulations on facebook, these details are not private any more anyway.

What would you recommend?

My master key is offline, and it has a primary user ID containing name, place at date of birth.

Jens Erat
  • 23,446
  • 12
  • 72
  • 96
  • " My master key is offline, and it has a primary user ID containing name, place at date of birth." => That's a neat idea, I think. I did it for my key too. :D – Diti May 09 '14 at 23:06
  • I'm not sure what the point of having a master key with name, place, and date of birth is if the UIDs are then attached to the keys anyway. Wouldn't it be the same if I just changed email addresses as necessary? – Soong Sep 09 '15 at 13:18
  • I'm not sure I really get your question. You can of course change mail addresses as you like, but remember changing a mail address means losing all incoming certifications for that user ID. – Jens Erat Sep 09 '15 at 16:13
  • Your clear explanations and information for all things PGP/GPG are invaluable @JensErat - Thank you so much! – friederbluemle Dec 03 '18 at 10:08