Offline master key

Large parts of this page originate from a discussion on the debian-project mailing list. See the info page for attributions.

Using subkeys and keeping the master key offline reduces the risk that it is stolen. Subkeys can be revoked easily without compromising the master key and losing its connection to the web of trust.

Without hardware

If you don't want to buy hardware, use an offline master key. See GnuPG/AirgappedMasterKey for a comprehensive step-by-step example. In brief: Create a certification only master key (1) using something like PGP Clean Room on a non-networked host, and store that on a USB key you only ever put into your machine when running your clean, non-networked, environment. Encryption of the filesystem provides additional security (2). Create at least 2 subkeys - signing + encryption - and use those in your day to day work. You then only need the master key when dealing with signing other keys, or updating your subkeys. In the event of your subkeys being compromised or lost or whatever you can just regenerate; because your master key is offline it should remain secure meaning you don't have to go through the pain of getting cross signatures again.

With hardware

If you want to buy hardware then one of the self contained USB tokens that look like a smartcard + reader to the OS is probably easiest. Unfortunately, most (all ?) only supports 3 keys on the device and those are one each of signing, encryption + authentication. Which means one can't have a master certification key and a signing subkey on the same device. Thus, if you can manage it, have 2 devices; one with the master and the other with your day-to-day keys. Otherwise having a master key that is signing enabled might be the best option. Some dongles can be configured to remember the passphrase for some time. It may be better to not remember the one of the signing key, but remembering the one of the encryption key for short while may be acceptable.

Notes on hardware:

Questions and answers:

Footnotes:

(1): A sign and certify master key could be useful to sign messages when one had to revoke every subkey and adding new subkeys is subject to a delay, for instance to explain to someone else the need for a new subkey or to sign votes or uploads in emergency. However, a certify-only master key forces its owner to manage the signing subkey correctly.

(2): Encrypting a USB device (memory card, ...) hides the fact that it contains a GPG key. When creating a LUKS filesystem, pass the --iter-time option to make a brute force decryption take much longer (at the cost of it taking slightly longer to decrypt and mount the partition).

(3): Open hardware is expected to be less likely to have backdoors. On the other hand, the designs tend to be bulkier and less robust than the mainstream device based on closed hardware.