PGP in Practice, Part 6: Generating your own PGP key (and not losing it)
Algorithm choice (Ed25519 + Curve25519 vs RSA-4096), subkey structure (offline primary + signing/encryption subkeys), passphrase hygiene (diceware), backup strategy (paperkey + 3-2-1), expiry policy (1–2 years), and the revocation certificate you should generate at creation time and store separately.
The single most important step in using PGP is the key generation ceremony. Done badly, the rest of the protocol stops protecting you. Done well, the key survives a decade of mail-client churn, OS reinstalls, lost laptops, and forgotten passphrases — without ever needing to re-issue.
This part is the one place I'm prescriptive instead of descriptive. There are sane defaults and there are bad ones; the gap between them is the difference between "PGP works for you" and "you'll be regenerating a key in two years and asking your correspondents to re-trust it."
OpenPGP supports many algorithms. The two reasonable choices in 2026 are:
-
Ed25519 / Curve25519 (ECC). Signing key is Ed25519, encryption subkey is Curve25519 (X25519). Modern, fast, small (~256-bit keys instead of RSA's 4096-bit), and standard since RFC 9580 (2024). Every current PGP client supports it. This is the default for new keys generated by Thunderbird, GPG Suite, Mailvelope, and Kleopatra.
-
RSA-4096. Older, slower, larger keys, but supported by every PGP client ever shipped. Choose RSA only if you correspond with someone using a very old client (e.g. a corporate gateway running gnupg 1.4) that doesn't speak ECC.
Don't choose:
- RSA below 3072 bits — too small in 2026.
- DSA — deprecated in OpenPGP since RFC 4880bis.
- Curves other than Curve25519 (e.g. NIST P-256) unless you have a specific compliance requirement. Curve25519 has a cleaner provenance.
gpg --full-generate-key walks the algorithm picker. Pick "ECC and ECC," then "Curve 25519." Or use the GUI: Thunderbird, Kleopatra, GPG Keychain, and Mailvelope all default to ECC for new keys.
A well-generated PGP key isn't one key — it's a primary key (used only to certify subkeys) plus 2–3 subkeys for daily operations:
Why split? The primary key holds your identity — your name, email, fingerprint, and the certifications other people made on your key. Re-issuing the primary key means re-publishing and asking everyone to re-trust. Subkeys, by contrast, are revocable and replaceable without touching the primary. If your laptop is compromised, you revoke the affected subkey, generate a new one, and the primary identity (and all the trust signatures on it) survives.
This is important enough that the recommended setup keeps the primary key offline — on an encrypted USB stick or a smartcard — and only the subkeys live on the laptop. lets you remove the primary's secret material from the working keyring after generation; the subkeys remain.