5
A little help with GnuPG (lemmy.world)
submitted 10 months ago by to c/privacy@lemmy.dbzer0.com
8 comments fedilink hide all child comments
 

I want to some guidance.

So let's say you created a PGP key & then proceeded to create 2 subkeys. Is it possible to just export the particular subkeys only. (let's say one for encryption & the other for signing) for OTHERS to import into their keyring for authentication & encryption ?

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 1 point 9 months ago (6 children)

Let's say I had a primary key that has a validity of 1 year & I didn't want to share that & instead sign messages with my sub-keys for let's say 4 months & use different sets of Subkeys with a validity of 4 months.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 2 points 9 months ago* (5 children)

    What purpose does (certifying with) the primary key serve there if you don't disclose it prior to rotation? What do you gain by not disclosing it when its only used in this context? It may be you haven't thought it through fully but otherwise sounds like you can get what you want by separate primary keys which you then manually --sign-key between on demand.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] [S] 1 point 9 months ago (4 children)

    The thing is with each new primary-keys you have build up trust, but subkeys are associated.

    It's a covenience thing

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 9 months ago* (3 children)

    The trust comes from the association. You can't remove (or keep private) the association and expect to not have to separately rebuild the trust as a consequence. That what you are trying to do is made is inconvenient in GPG is quite intentional I believe. Or maybe I misunderstand your motivations, it's a bit ambiguous and you leave a lot open for interpretation.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] [S] 1 point 9 months ago (2 children)

    I just want to know if it can be done or not, if it cannot be done, then why ? If it can then how ?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 9 months ago* (last edited 9 months ago) (1 child)

    Because it's not something people commonly do. Because the GPG authors wanted to design for and encourage what they consider appropriate use and discourage and make difficult (but not impossible) what they consider inappropriate use. Removing a footgun for people not fully understanding the trust model of PGP or just slipping up doing that and then ending up in situations they didn't account for. In general I could have a lot of criticism of the UI/UX of GPG but in this case I can see where they're coming from and find this thread supporting it as working as intended so far.

    That you need to have deep knowledge of obscure GPG internals to pull this off is by design. It's not considered part of intended use. Similar thinking to why in Chromium you don't have a button to bypass HSTS validation error but need to type in the cheat code "thisisunsafe". It nudges users to stop and think more consciously about what's going on.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •