Which keys gpg exports and what is in the keyrings

gpg

I've been making my way through what's on the internet concerning gpg lately. And I must say it's pretty confusing.

Particularly, the importing/exporting part. When you generate a key, you basically get 4 keys by default. What are possible ways to export the keys (only one key, several keys at once)? What are possible ways to delete keys (the same)? Also, I'm now not sure, if I interpret gpg --list-keys, gpg --list-secret-keys results correctly. E.g., I seem to export only one key (subkey, gpg --export SUB_ID!), but when importing I get primary key as well.

Best Answer

What I've managed to find out. Correct me if I'm wrong.

There are public and private keys, they go in pairs. There are primary keys and each primary key can have one or more subkeys. By default, when you generate a key, you get four keys ((1) RSA and RSA (default)). One keypair for signing and certification (primary keys) and one keypair for encryption (subkeys). Also, there are two keyrings, for private and for public keys.

And now to the tricky part. I was experimenting with importing/exporting keys. For that I created a key with 2 subkeys. Then I exported it in different ways:

$ gpg --export PRI_ID > ~/_/export-1
$ gpg --export PRI_ID! > ~/_/export-2
$ gpg --export SUB_ID_1! > ~/_/export-3
$ gpg --export SUB_ID_2! > ~/_/export-4
$ gpg --export-secret-keys PRI_ID > ~/_/export-secret-keys-1
$ gpg --export-secret-keys PRI_ID! > ~/_/export-secret-keys-2
$ gpg --export-secret-keys SUB_ID_1! > ~/_/export-secret-keys-3
$ gpg --export-secret-keys SUB_ID_2! > ~/_/export-secret-keys-4
$ gpg --export-secret-subkeys PRI_ID > ~/_/export-secret-subkeys-1
$ gpg --export-secret-subkeys PRI_ID! > ~/_/export-secret-subkeys-2
$ gpg --export-secret-subkeys SUB_ID_1! > ~/_/export-secret-subkeys-3
$ gpg --export-secret-subkeys SUB_ID_2! > ~/_/export-secret-subkeys-4

And started exporting keys, and see what happens:

$ gpg --delete-secret-key PRI_ID; gpg --delete-key PRI_ID; gpg --import ~/_/export-1; gpg -k; gpg -K
$ gpg --delete-secret-key PRI_ID; gpg --delete-key PRI_ID; gpg --import ~/_/export-2; gpg -k; gpg -K
$ gpg --delete-secret-key PRI_ID; gpg --delete-key PRI_ID; gpg --import ~/_/export-3; gpg -k; gpg -K
$ gpg --delete-secret-key PRI_ID; gpg --delete-key PRI_ID; gpg --import ~/_/export-4; gpg -k; gpg -K
$ gpg --delete-secret-key PRI_ID; gpg --delete-key PRI_ID; gpg --import ~/_/export-secret-keys-1; gpg -k; gpg -K
$ gpg --delete-secret-key PRI_ID; gpg --delete-key PRI_ID; gpg --import ~/_/export-secret-keys-2; gpg -k; gpg -K
$ gpg --delete-secret-key PRI_ID; gpg --delete-key PRI_ID; gpg --import ~/_/export-secret-keys-3; gpg -k; gpg -K
$ gpg --delete-secret-key PRI_ID; gpg --delete-key PRI_ID; gpg --import ~/_/export-secret-keys-4; gpg -k; gpg -K
$ gpg --delete-secret-key PRI_ID; gpg --delete-key PRI_ID; gpg --import ~/_/export-secret-subkeys-1; gpg -k; gpg -K
$ gpg --delete-secret-key PRI_ID; gpg --delete-key PRI_ID; gpg --import ~/_/export-secret-subkeys-2; gpg -k; gpg -K
$ gpg --delete-secret-key PRI_ID; gpg --delete-key PRI_ID; gpg --import ~/_/export-secret-subkeys-3; gpg -k; gpg -K
$ gpg --delete-secret-key PRI_ID; gpg --delete-key PRI_ID; gpg --import ~/_/export-secret-subkeys-4; gpg -k; gpg -K

Here are my conclusions, which somewhat contradict what is in the manual pages:

`gpg --export PRI_ID` exports all public keys (3 keys)
`gpg --export PRI_ID!` exports primary public key (1 key)
`gpg --export SUB_ID!` exports public primary key and public subkey (2 keys)
`gpg --export-secret-keys PRI_ID` exports all 3 keypairs (6 keys)
`gpg --export-secret-keys PRI_ID!` exports primary keypair (2 key)
`gpg --export-secret-keys SUB_ID!` exports primary keypair and subkey keypair (4 keys)

gpg --export-secret-subkeys is like gpg --export-secret-keys, but doesn't export private primary key (or makes it useless as they say, sec#). Generally, PRI_ID, SUB_IDs are interchangeable, unless you put exclamation mark after them. But for --delete-key, --delete-secret-key they are interchangeable even with exclamation key.

UPD According to gpg --list-packets I seem to be wrong and there is no contradiction with man pages. --export-secret-keys must be exporting secret keys after all. It's just that a public key may be inferred from a private one.

However, there's one thing left after all. What kind of connection between primary keys and subkeys? Why when I export a subkey, I get primary key as well?

UPD Oh, and each keypair shares one and the same id.

Related Question