[SOLVED] GnuPG recovery question

Tekth · 06-07-2011, 11:41 AM

I have been using GnuPG for a couple of weeks now in order to encrypt my personal files on my computer. I have subsequently been backing up those files to Spider Oak's online backup service. Encrypting and Decrypting work great while my computer is in good working order.

My Question is if my computer takes a dump and i have to wipe it or anything else of the sort, how am I to decrypt my backed-up encrypted files once i get them again? Is it possible to reinsert private keys into GnuPG for such a disaster? Also (last one i promise), do key servers only store your public keys, making me solely responsible for my private keys safety?

anomie · 06-07-2011, 12:19 PM

You can take a backup of ~/.gnupg, or you can use my preferred method...

Back up keys

Code:

$ gpg --export > pubkeys
$ gpg --export-secret-keys > privkeys
$ gpg --export-ownertrust > trustdb

Copy each of those files to media that you can keep somewhere safe. (IOW, especially do not keep the privkeys file in clear text out on the 'net somewhere.)

Restore keys

Code:

$ gpg --import pubkeys
$ gpg --import privkeys
$ gpg --import-ownertrust trustdb

Key servers only store your public keys. Keeping your private keys safe and intact is your responsibility.

anomie · 06-07-2011, 12:23 PM

I'd add: your private keys (in this scenario) are just as important as your data backups, so treat them as such. Without the private keys, you - quite literally - have no data backups. I keep mine on a USB drive in a secure place.

Tekth · 06-07-2011, 01:10 PM

Thanks for the info/help. Im still getting used to how the whole public private key thing works.

Tekth · 06-08-2011, 01:21 PM

Ok, I have done that and have backed them up to a separate non-volatile media. What I am concerned with now is that Im not sure if the above procedure backed up anything I have in Seahorse. I have several passwords in my keyring within seahorse and Id like to back those up as well. Does the procedure you mentioned only backup the keys directly created from gpg and nothing else?

sundialsvcs · 06-09-2011, 09:11 AM

Keep a safe copy of the file in which the keyring is stored. Know what master password is used to encrypt it. Know exactly what version of the software is used.

Public key encryption, as you know, involves the use of a pair of keys, one of which is generated based on the other (but not the other way around). Data which has been encrypted by one can only be decrypted by the other and vice-versa. This is the core concept around which the entire scheme is based.

anomie · 06-09-2011, 04:47 PM

Quote:

Originally Posted by Tekth

I have several passwords in my keyring within seahorse and Id like to back those up as well. Does the procedure you mentioned only backup the keys directly created from gpg and nothing else?

Yes, that's correct. Unfortunately I am not very familiar with Seahorse. (Perhaps a new thread, with the question focused on Seahorse, and with the side note that you've already backed up GnuPG keys, would be a good idea.)