Best Practice, subkeys and subkey cross-certification.

[Chuck Peters]

I attended a small key signing party Saturday after generating a new key
with multiple subkeys with the notion of having a email signing keys on
less secure systems like my VPS (using mutt) and a separate subkey for
each computer or device.

https://wiki.debian.org/subkeys says "The really useful part of subkeys
is that they can be revoked independently of the master keys, and also
stored separately from them." ?So I can keep my primary key off the
network and use it only for signing other peoples keys. ?

Another sensible precaution is to have different passphrases for each of
these subkeys. ?However when working with the full key set when I
attempted to change the passphrase for a subkey, it also changed the
passphrase for the main key. ?I'm assuming at this point when I separate
the keys, I can change the passphrase as planned... ?Is this a bug?
?Should I file a bug report? ??

Then I decided I should do some more reading and get a better
understanding of subkeys and of the more recent documentation and blogs
I found the following:?
http://www.gnupg.org/faq/subkey-cross-certify.en.html
https://alexcabal.com/creating-the-perfect-gpg-keypair/
http://blog.dest-unreach.be/wp-content/uploads/2009/04/pgp-subkeys.html
https://grepular.com/Android_Privacy_Guard_and_Subkeys

OK, the FAQ is the first I heard about?subkey cross-certification. ?Is
that info current and correct? ?What is recommended?


Does anyone have some pointers on personal or organizational Policy and
Best Practices documents under a copyright or license terms that allow
modification?


Thanks,
Chuck

[Hauke Laging]

Post by Chuck Peters
I attended a small key signing party Saturday after generating a new key
with multiple subkeys with the notion of having a email signing keys on
less secure systems like my VPS (using mutt) and a separate subkey for
each computer or device.

Would you explain that in more detail? I am not sure whether that makes sense.

Post by Chuck Peters
So I can keep my primary key off the
network and use it only for signing other peoples keys.

You should consider not only storing the key offline but using it in a safe
environment only. Besides managing your own and other keys it makes sense to
use it for signing very important data (like your key policy).

Post by Chuck Peters
Another sensible precaution is to have different passphrases for each of
these subkeys. However when working with the full key set when I
attempted to change the passphrase for a subkey, it also changed the
passphrase for the main key. I'm assuming at this point when I separate
the keys, I can change the passphrase as planned... Is this a bug?

GnuPG can use keys with subkeys which have different passphrases but it cannot
create such keys (at least not with "normal operation"). This is not a bug,
just a missing feature.

Post by Chuck Peters
OK, the FAQ is the first I heard about subkey cross-certification. Is
that info current and correct? What is recommended?

Don't care about that, it's handled automatically.


Hauke
--
Crypto f?r alle: http://www.openpgp-schulungen.de/fuer/bekannte/
OpenPGP: 7D82 FB9F D25A 2CE4 5241 6C37 BF4B 8EEF 1A57 1DF5
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 572 bytes
Desc: This is a digitally signed message part.
URL: </pipermail/attachments/20130924/44e6b5e4/attachment.sig>

[Peter Lebbing]

Post by Chuck Peters
https://alexcabal.com/creating-the-perfect-gpg-keypair/

Let me quote what Hauke wrote one and a half month ago, because I fully agree
:). Oh, and it's relevant.

Post by Chuck Peters
To me this seems to be a really strange article. My advise is to ignore that.

I haven't looked at the latter two links you gave, but I recognised this link
from your list.

HTH,

Peter.