Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've created a new GPG key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure because if the key is compromised or stolen the damage will be limited.

But then I thought about the day when I will need to sign my new key. Signing the new key with the old key seems equivalent to keeping the old key, and thus adds nothing to security.

Does setting an expiration date improve key security? If so, what's the best expiration/key replacement policy?

share|improve this question

2 Answers 2

Does setting an expiration date improves key security?

Yes. You've already said why, too:

It seemed like a good security measure, because if the key is compromised or stolen - the damage will be limited.

Assuming you are compromised and the key is stolen, clearly, your first action would be to revoke the key and issue a new one. However, not everyone will check for revoked keys; they'll continue blindly using it until it becomes invalid.

Likewise, if you're compromised, somebody can only pretend to be you for a fixed window.

If so, what's the best expiration\key replacement policy?

There really isn't one - the question is more "what is the best I can do given constraints X Y Z". For example, if you set the Window too small, you inconvenience users; however, too high and you open up the risk if compromised. It really comes down to a judgement call - how sensitive exactly is what you're protecting and how often/inconvenient is it to replace keys frequently?

share|improve this answer
By "policy" I actually meant the procedure to undertake when a key is naturally expired. –  Adam Matan May 8 '12 at 12:39
This is plain wrong, if your key is stolen, the thief can pretend to be you forever, as he can prevent it from expiring. –  remram Feb 27 at 17:01

Note that an expiration date on the master key doesn't really do anything for security, as anyone who compromised that could always just extend it anyway. See http://madduck.net/blog/2006.06.20:expiring-gpg/.

(Expiring subkeys, on the other hand, can be useful, and the option at key creation sets the date on all of the keys.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.