How to add the picture to the public key using GnuPG

gnupgpublic-key

I've created a key pair using GnuPG. I've read that in addition to multiple identities and email addresses, one can also embed a small image (most usually of the user) to help perhaps with memory recall or to verify visually the identity of a person, say at key-signing parties etc.

How do I go about doing this with GnuPG 1.4.10 on Windows 7?

Best Answer

Run

  gpg --edit-key <your key id>

This will start gpg's key editing mode. Then use the command addphoto:

gpg> addphoto

Pick an image to use for your photo ID. The image must be a JPEG file. Remember that the image is stored within your public key. If you use a very large picture, your key will become very large as well! Keeping the image close to 240x288 is a good size to use.

Enter JPEG filename for photo ID:

Related Solutions

How to export public keys in PEM format with GnuPG

You need the gpgsm utility, but, yes, you can.

gpgsm -o secret-key.p12 --export-secret-key-p12 0xXXXXXXXX

It contains keys and certificates. Then you can split them with openSSL and transform it in .pem at the same time

openssl pkcs12 -in secret-key.p12 -nocerts -out gpg-key.pem
openssl pkcs12 -in secret-key.p12 -nokeys -out gpg-certs.pem

How to manage GPG keys across multiple systems

Well, this is a bit embarrassing. I've spent hours over the course of a week trying to figure this problem out, and the answer appears to lie with subkeys--a topic the GnuPG manual and FAQ glosses over.

While researching what subkeys are and why they might be used instead of --gen-key, I stumbled across this gem: http://wiki.debian.org/subkeys.

Debian's wiki explains how to implement option #2 (see OP) using a master key with subkeys, and further explains how to remove the master key from any system after storing it on a backup medium (e.g. a flash drive). The subkeys can then be distributed among my keyrings on each device.

Pros:

Does not rely mainly on password to protect master key,
If any system is compromised, the master key is not immediately available (unless I foolishly leave my flash drive plugged in, or attach said drive to a compromised system),
This is a practice implemented by the Debian development team.
Uses the subkey feature of GnuPG. Which seems a bit more organized than having a bunch of loose keys on your keyring, yes?

Relevant portion from Debian Subkey Wiki

Make backups of your existing GnuPG files ($HOME/.gnupg). Keep them safe. If something goes wrong during the following steps, you may need this to return to a known good place. (note: umask 077 will result in restrictive permissions for the backup.)
- umask 077; tar -cf $HOME/gnupg-backup.tar -C $HOME .gnupg
Create a new subkey for signing.
- Find your key ID: gpg --list-keys yourname
- gpg --edit-key YOURMASTERKEYID
- At the gpg> prompt: addkey
- This asks for your passphrase, type it in.
- Choose the "RSA (sign only)" key type.
- It would be wise to choose 4096 (or 2048) bit key size.
- Choose an expiry date (you can rotate your subkeys more frequently than the master keys, or keep them for the life of the master key, with no expiry).
- GnuPG will (eventually) create a key, but you may have to wait for it to get enough entropy to do so.
- Save the key: save
You can repeat this, and create an "RSA (encrypt only)" sub key as well, if you like.
Now copy $HOME/.gnupg to your USB drives.
Here comes the tricky part. You need to remove the private master key, and unfortunately GnuPG does not provide a convenient way to do that. We need to export the subkey, remove the private key, and import the subkey back.
- Export the subkeys: gpg --export-secret-subkeys YOURMASTERKEYID >secret-subkeys (to choose which subkeys to export, specify the subkey IDs each followed with an exclamation mark: gpg --export-secret-subkeys SUBKEYID! [SUBKEYID! ..])
- Remove your master secret key: gpg --delete-secret-key YOURMASTERKEYID
- Import the subkeys back: gpg --import secret-subkeys
- Verify that gpg -K shows a sec# instead of just sec for your private key. That means the secret key is not really there. (See the also the presence of a dummy OpenPGP packet in the output of gpg --export-secret-key YOURMASTERKEYID | gpg --list-packets).
- Optionally, change the passphrase protecting the subkeys: gpg --edit-key YOURMASTERKEYID passwd. (Note that the private key material on the backup, including the private master key, will remain protected by the old passphrase.)

Your computer is now ready for normal use.

When you need to use the master keys, mount the encrypted USB drive, and set the GNUPGHOME environment variable:

export GNUPGHOME=/media/something
gpg -K

or use --home command-line argument:

gpg --home=/media/something -K

The latter command should now list your private key with sec and not sec#.

Multiple Subkeys per Machine vs. One Single Subkey for All Machines

Excerpt from Debian subkey wiki. Originally noted in comments. [Paraphrasing] and emphasis mine.

One might be tempted to have one subkey per machine so that you only need to exchange the potentially compromised subkey of that machine. In case of a single subkey used on all machines, it needs to be exchanged on all machines [when that single subkey is or suspected to be compromised].

But this only works for signing subkeys. If you have multiple encryption subkeys, gpg is said to encrypt only for the most recent encryption subkey and not for all known and not revoked encryption subkeys.