Contents
When do you create an OpenPGP key you create two subkeys?
When you create an OpenPGP key with GPG (which is the focus of this article), you create two subkeys by default: one for encryption and one for signing. The subkeys discussed in this article are only used for signing. The reason for this is that it is impossible to sensibly employ multiple encryption subkeys.
How to improve the security of your OpenPGP key?
The only sensible thing would be to distribute the public part of every encryption subkey and then anybody encrypting anything to you would need to send you the same message once for each encryption subkey you have created. This could certainly be problematic.
What are the two main uses of OpenPGP?
There are two main uses of OpenPGP: encryption, and signing. When you create an OpenPGP key with GPG (which is the focus of this article), you create two subkeys by default: one for encryption and one for signing. The subkeys discussed in this article are only used for signing.
What do you use the default subkey for?
The default subkey is used for encryption and decryption of messages. Additional subkeys can be created for signing. Though it is important that your subkeys are kept safe, you can always revoke a subkey if it is compromised and create a new one with the original master key.
How to create an OpenPGP public / private key pair?
Create and export an OpenPGP Public/Private Key pair Launch Seahorse. It should be installed by default. Select GnuPG keys. Select the + sign to create a new key. Select PGP Key. Enter your email and the name you would like to be associated with the key. This doesn’t need to be your real name. Select advanced options. Encryption type should be RSA.
How to change sub key usage of a PGP key?
Notice now that our key gained signing capability. That’s it! In order to add a new subkey with specific usages, start gpg2 with the –expert switch. Then the options are
What happens if you do not have a backup of your OpenPGP key?
If you do not have a backup of your key stored somewhere, you are stuck generating a new key. Even if you do have a backup somewhere, you will be left wondering if the key on the mobile device has been compromised in some way.
Can a subkey be signed by the same person?
They all associate to their primary key, so anything signed by any subkey can be associated with the main key and can hence be considered to be signed by the same person. There are a number of advantages to employing the approach documented here to managing your GPG key.
Why do I need a GPG secret key?
The principal reason is that should you have your GPG secret key loaded on a mobile device and that device is stolen, you will find yourself with a serious problem. If you do not have a backup of your key stored somewhere, you are stuck generating a new key.