I have generated one RSA-2048 signing key and one DSA-2048 signing key, using gpg command

gpg --full-generate-keys

I would expect the key to have size 2048 bits, however, running the command

gpg --export-secret-keys <key-id> | wc -c

gives a size of 1353Bytes for the RSA private key and 1103Bytes for the DSA private key. The public keys are 656Bytes and 1020Bytes.

Why is this? Is this because the exponent and primes, passphrases, my name etc are stored together with the keys?

  • $\begingroup$ The passphrase is not stored -- at least not as part of the key or on disk. If you use an 'agent' process it often retains the passphrase(s) in memory, to use in accessing the key(s), as long as you remain logged-in. Using a GPG agent used to be a fairly complicated option and thus rare, but in recent years it has become the default or at least convenient on more and more systems, especially Linuxes. $\endgroup$ – dave_thompson_085 Apr 7 at 2:40

Yes. There is a difference between key strength, key size and the size of the encoding of a key.

The modulus of the RSA private key determines the key size, for instance, but an RSA key commonly also contains the public, private exponent and CRT parameters, an encoding structure etc. etc.

In GPG indeed the "key" consists of many additional parts as well (as you can see from the size). You can packet-inspect the keys in GPG by simply performing gpg <exported-key>.

See here for more information (and note that the question really belongs on Superuser, but whatever).

| improve this answer | |
  • $\begingroup$ Actually, this is about a cryptographic exchange format and argueably on-topic here. $\endgroup$ – SEJPM Apr 6 at 12:30
  • $\begingroup$ Also relevant RFC4880 (in particular section 5 which specifies that the primes and $p^{-1}\bmod q$ are part of the RSA private key and group parameters are part of the DSA public key). $\endgroup$ – SEJPM Apr 6 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.