Contents
What are subkeys GPG?
OpenPGP supports subkeys which are like the normal keys, except they’re bound to a master key pair. A subkey can be used for signing or for encryption. The really useful part of subkeys is that they can be revoked independently of the master keys, and also stored separately from them.
What is revocation certificate GPG?
The revocation certificate is a means to mark your key as invalid – in case you lost your secret key, or that your key has been compromised. Of course, this information has to be passed on to all senders.
Should I use GPG subkeys?
A subkey can be used for signing or for encryption. The really useful part of subkeys is that they can be revoked independently of the primary keys, and also stored separately from them. Without a subkey for encryption, you can’t have encrypted e-mails with GnuPG at all.
How to revoke a secret key in GnuPG?
For every signature which has been generated by one of the secret keys, GnuPG asks whether a revocation certificate should be generated. Check the signatures on all selected user IDs. With the extra option selfsig only self-signatures are shown. Create an additional user ID.
Where is the revocation certificate stored in OpenPGP?
Generate a new key pair using the current default parameters. This is the standard command to create a new key. In addition to the key a revocation certificate is created and stored in the openpgp-revocs.d directory below the GnuPG home directory.
How big of a keypair do I need for GnuPG?
Generating a new keypair. The size of a DSA key must be between 512 and 1024 bits, and an ElGamal key may be of any size. GnuPG, however, requires that keys be no smaller than 768 bits. Therefore, if Option 1 was chosen and you choose a keysize larger than 1024 bits, the ElGamal key will have the requested size, but the DSA key will be 1024 bits.
What happens if I Lose my GPG key?
If by any eventuality you’d loose access to those laptop keysyou could easily revoke them with the master key and generate a new set to replace them, but the master key pair (and thus your PGP/GPG ID) would remain the same. Sounds good? Let’s generate a new subkey for signing.