46

What are the critical files I need to backup from GPG? I guess my private key would qualify of course, but what else?

030
  • 5,731
  • 12
  • 61
  • 107
jldupont
  • 1,779
  • 4
  • 23
  • 27

6 Answers6

47

The most critical are your secret/private keys:

gpg --export-secret-keys > secret-backup.gpg

secret-backup.gpg is then the file to keep safe.

Otherwise the ~/.gnupg/ directory contain all private and public keys(secring.gpg and pubring.gpg respectively) as well as configuration and trustdb which could be convenient to have stored.

hultqvist
  • 701
  • 5
  • 13
15

There is nothing special. Let's assume your@id.here is your ID.:

Export keys and ownertrust:

gpg --export --armor your@id.here > your@id.here.pub.asc
gpg --export-secret-keys --armor your@id.here > your@id.here.priv.asc
gpg --export-secret-subkeys --armor your@id.here > your@id.here.sub_priv.asc
gpg --export-ownertrust > ownertrust.txt

Import keys and ownertrust:

gpg --import your@id.here.pub.asc
gpg --import your@id.here.priv.asc
gpg --import your@id.here.sub_priv.asc
gpg --import-ownertrust ownertrust.txt

Ultimately trust the imported key:

gpg --edit-key your@id.here
gpg> trust
Your decision? 5 (Ultimate trust)
serghei
  • 251
  • 2
  • 5
13

The easiest way would be to grab the entire GnuPG directory - usually ~/.gnupg/, it contains all private keys you have, as well as the public keyring and other useful data (trustdb, etc.)

user1686
  • 8,717
  • 25
  • 38
7

In addition to @serghei's answer, check the documentation of gnupg. It says that you should backup:

  • ~/.gnupg/gpg.conf (standard configuration file)
  • ~/.gnupg/pubring.gpg (legacy public keyring)
  • ~/.gnupg/pubring.kbx (new public keyring using keybox format)
  • ~/.gnupg/openpgp-revocs.d/ (revocation certificates)

It suggests also to backup the ownertrust

gpg --export-ownertrust > otrust.txt

Of course, you should backup your secret keys as well. If I understand correctly, the quickest way would be using tar to backup the whole ~/.gnupg except revocation certificates ~/.gnupg/openpgp-revocs.d/. You may consider to print revocation certificates as a QR code (qrencode) or instead, print out secret keys with the utility paperkey (see reference). Remember that if you keep your private keys and revocation certificates in one device, an attacker can revoke your public key and issue a new one claiming to be you.

Reference: An Advanced Introduction to GnuPG, Neal H. Walfiel section 6.3.8 (creating a backup).

Firmin Martin
  • 171
  • 1
  • 4
  • Why do we have to backup the public keyring? Aren't the public keys part of the secret keys? So exporting the secret keys + owner trust should be enough – JellyFilledNuts Oct 13 '21 at 19:22
  • 1
    @JellyFilledNuts It may contain other people's public key, thus not part of the secret ones you own. See [the documentation](https://www.gnupg.org/gph/en/manual/x56.html). In that perspective, it's not dramatic to lose them, just not very handy. – Firmin Martin Oct 13 '21 at 20:02
  • 1
    I see, that makes sense. Thanks. I did not think about that aspect because so far I'm using GPG only for signing commits and encrypting stuff – JellyFilledNuts Oct 13 '21 at 21:33
2

You definitely want to backup your private key and the revocation file you created.

PEra
  • 2,825
  • 17
  • 14
0

You may also want to back up any keys you've signed or ones you don't feel like re-downloading off the key servers.

At a minimum, all you need is your complete key.

Broam
  • 130
  • 6