Move GPG Keys from One Machine to Another

gpg-key-migration.md

Migrate GPG Keys from One Workstation to Another

Replace [your key] with your key ID

To obtain your key ID

gpg --list-secret-keys --keyid-format LONG

Which returns something like

/home/angela/.gnupg/pubring.kbx
-------------------------------
sec   rsa4096/[your key] 2018-03-30 [SC]
      ABCDEFGHIJKLMNOPQRSTUVWXYZ
uid                 [ unknown] angela (KEY NAME) <user@domain>
ssb   rsa4096/ABCDEFGHIJKL 2018-03-30 [E]

After the key size rsa4096/ is your key ID.

---

Export the key in preparation to move it

gpg --export -a [your key] > gpg-pub.asc

Prepare the secret key for migration (if password protected, you'll be prompted to enter it)

gpg --export-secret-keys -a [your key] > gpg-sc.asc

Find them

ls -l gpg*.asc

Drag the key pair from the current directory to your USB stick or however else you move them.

Once on the new machine, import them

gpg --import gpg-pub.asc

If password protected, you'll be prompted to enter it

gpg --import gpg-sc.asc

If you need to adjust the trust level

gpg --edit-key [your key]

Thanks so much for these instructions – they are concise and very helpful.

One thing I had to do was restart gpg-agent after importing the public key and adjusting the trust level. I couldn’t import the secret key until restarting the agent:

sudo gpgconf --kill gpg-agent

I'm on Mac OS Monterey 12.1 for both old and new machines.

The error I received when trying to import the secret key was:

gpg: key <key-id>: "<key-description>" not changed
gpg: key <key-id>: error sending to agent: Permission denied
gpg: error building skey array: Permission denied
gpg: error reading '/path/to/gpg-sc.asc': Permission denied
gpg: import from '/path/to/gpg-sc.asc' failed: Permission denied
gpg: Total number processed: 0
gpg:              unchanged: 1
gpg:       secret keys read: 1

You're very welcome! Glad it was helpful.

Thanks for the tip, I often work with Macs at work and have yet to deal with Monterey - that will no doubt come in handy!

Thank you both! This was a huge time saver. I was about to generate a new one.

Thank you very much!

Just a note, this doesn't migrate all keys. If GnuPG is used as ssh-agent, it somehow allows keys within private-keys-v1.d to be included via the sshcontrol file even though ti doesn't show them to any other command including gpg --list-secret-keys --keyid-format LONG

I'm currently looking for a way to either extract them from there into a normal format...