Secure way to transfer public/secret key to second computer

Encrypt your private key with a long password and decrypt it on the target computer. Here's how:

First, export the public key:

gpg --output public-key.gpg --export {KEYID}

Then export the secret key and encrypt the result before it's written to disk:

gpg --output - --export-secret-key {KEYID} |\
gpg --armor --output secret-key.asc --symmetric --cipher-algo AES256

Use either a very long or just entirely random password for the encryption.

Then transfer the keys.asc on a FAT-formatted flash and shred them afterwards, or if you know how to destroy CDs (ENTIRELY), use a CD and then destroy it.

To import the key on the other machine, run:

gpg --no-use-agent --output - keys.asc | gpg --import

This will prompt for your password, then decrypt and import the key.

Make sure you destroy the encrypted file after running this! On a small file like a private key bruteforcing the password is fairly trivial and can be done in a matter of weeks to months depending on the hardware available to the attacker. The attacker's job is further simplified by the fact that the structure of a PGP private key is publicly known, so known-cleartext attacks can be attempted. If the encrypted version of your private key is leaked, revoke the key and generate a new one IMMEDIATELY.

Source for the commands: http://montemazuma.wordpress.com/2010/03/01/moving-a-gpg-key-privately/


There's no better way, really (at least if you did the copy with an eavesdropping-resistant medium, e.g. through a SSH tunnel, or with a USB key). The key files being stored as files on the hard disks of both systems, this is a simple data transfer issue.

Ultimately, your private keys are protected by your passphrase.

(Of course, public keys can be transfered by any way you see fit, without any security issue: they are public.)


Encrypt your public and private key before you transfer them to another computer. Use a 30 character random password. Decrypt the file on the other computer with the same password.

Tags:

Encryption

Pgp