Master Keys vs. Subkeys

Understanding PGP Key Architecture

When you first created your PGP key pair, you may have noticed that the process actually generated multiple keys. This isn't a coincidence—modern PGP implementations use a sophisticated key architecture with multiple components serving different functions.

The default key structure includes:

The Benefits of Subkeys

The subkey architecture provides several important security and practical benefits:

Reviewing Your Key Structure

Before making any changes, let's examine your current key structure to understand what you're working with.

In Secure Mail Client

To view your key details in Secure Mail Client:

1. Navigate to Settings → Keys
2. Select your key from the list
3. Click "View Details" or a similar option
4. Look for a section showing "Master Key" and "Subkeys"

Using the Command Line

For more detailed information, you can use the command line with GPG:

      
        
gpg --list-secret-keys --keyid-format LONG

      
    

This command will show output similar to:

sec   rsa4096/0x3AA5C34371567BD2 2025-04-08 [SC] [expires: 2027-04-08]
      Key fingerprint = 867F BB5C 9407 9D74 EB8C  5358 3AA5 C343 7156 7BD2
uid                   [ultimate] Your Name <[email protected]>
ssb   rsa4096/0x4BB6D45482678BE3 2025-04-08 [E] [expires: 2026-04-08]

In this example:

• sec refers to the master (secret) key with ID 3AA5C34371567BD2 and capabilities [SC] (Sign and Certify)
• ssb refers to a subkey with ID 4BB6D45482678BE3 and capability [E] (Encryption)

For even more detailed information, examine a specific key:

      
        
gpg --edit-key [email protected]

      
    

At the GPG prompt, type:

      
        
gpg> list

      
    

This will show all keys with their capabilities, creation dates, expiration dates, and more. Type quit to exit without making changes.

The Optimal Key Structure

For most users, the recommended PGP key structure consists of:

This structure achieves the ideal balance between security, usability, and key management.

Creating the Optimal Key Structure

If your key doesn't already have this structure, you can modify it to align with these best practices. There are two main approaches:

Approach 1: Modify Your Existing Key

If you already have a PGP key and want to adapt it to the recommended structure:

Step 1: Back up your keys

      
        
# Export your secret keys
gpg --export-secret-keys --armor [email protected] > master_and_subkeys_backup.asc

# Export your public key
gpg --export --armor [email protected] > public_key_backup.asc

      
    

Step 2: Restrict your master key to Certify only

If your master key has signing capability, you should remove it to follow best practices:

      
        
gpg --edit-key [email protected]

      
    

At the GPG prompt:

Step 3: Add a dedicated signing subkey (if needed)

      
        
gpg --edit-key [email protected]

      
    

At the GPG prompt:

Step 4: Add an authentication subkey (optional)

      
        
gpg --expert --edit-key [email protected]

      
    

At the GPG prompt:

Approach 2: Create a New Key with the Optimal Structure

If you prefer to start fresh with an optimal key structure, you can create a new key with the correct configuration from the beginning:

      
        
gpg --expert --full-generate-key

      
    

Follow these steps during the interactive process:

1. Select option (8) RSA (set your own capabilities)
2. Toggle capabilities until only Certify remains
3. Set keysize to 4096 bits
4. Set expiration to 2-3 years
5. Enter your user information (name, email, comment)
6. Create a strong passphrase

Once your master key is created, follow the steps above to add encryption, signing, and authentication subkeys.

If you create a new key and want to transition from your old key, you should:

1. Sign your new key with your old key to establish trust
2. Publish your new key to key servers
3. Notify your contacts of your key transition
4. Consider creating a transition statement signed by both keys

Securing Your Master Key

The most important outcome of the master/subkey architecture is that you can keep your master key offline and secure while using only your subkeys for daily operations.

Secure Storage Options

Consider these options for secure master key storage:

Exporting Your Master Key

To move your master key offline, you need to:

1. Export your entire keyring

         
           
   gpg --export-secret-keys --armor [email protected] > master_key_backup.asc
   
         
       

2. Move this file to your secure storage medium
3. Create a revocation certificate

         
           
   gpg --gen-revoke --armor [email protected] > revocation_certificate.asc
   
         
       

   Store this separately from your master key for emergency use if your key is compromised.

4. Remove the master key from your daily-use keyring

         
           
   gpg --export-secret-subkeys [email protected] > subkeys_only.gpg
   gpg --delete-secret-keys [email protected]
   gpg --import subkeys_only.gpg
   
         
       

   This sequence exports just your subkeys, deletes your entire secret keyring, then imports only the subkeys.

5. Verify that only subkeys remain

         
           
   gpg --list-secret-keys [email protected]
   
         
       

   You should see a "#" after "sec" indicating the master key is not available.

Subkey Rotation Practices

A key advantage of the subkey architecture is the ability to rotate keys periodically for enhanced security. Here's a recommended process:

Extending Key Expirations

Before subkeys expire, you should extend their expiration dates:

1. Import your master key from your secure storage
2. Edit your key

         
           
   gpg --edit-key [email protected]
   
         
       

3. Select the key to modify
   gpg> key 1 # Select first subkey
4. Set a new expiration
   gpg> expire Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years Key is valid for? (0) 1y
5. Repeat for all subkeys using key 1, key 2, etc.
6. Save your changes
   gpg> save
7. Remove the master key from your daily-use keyring again
8. Publish your updated key to key servers

Creating New Subkeys

For maximum security, you may want to periodically create entirely new subkeys:

1. Import your master key from your secure storage
2. Revoke the old subkey (optional, but recommended for clarity)

         
           
   gpg --edit-key [email protected]
   
         
       

   gpg> key 1 gpg> revkey
3. Add new subkeys following the procedures described earlier
4. Export your updated public key and publish it
5. Secure your keyring by removing the master key again

Conclusion

The master/subkey architecture is one of the most powerful features of modern PGP implementations, allowing you to maintain a secure, long-term cryptographic identity while minimizing day-to-day exposure of your critical key material.

By implementing the practices outlined in this module, you've significantly enhanced the security of your PGP setup and reduced the risk of catastrophic key compromise.

In the next module, we'll explore how to further enhance your security by moving your subkeys to a hardware security device like a YubiKey, creating a nearly impenetrable encryption system.