2

Most of the public keys I am getting from friends have a sub key in addition to the pub key. For educational purposes I retrieved some public keys and came across this Linus Torvalds' key that does not have a sub-key.

pub   1024D/956EB7BF449FA3AB 1999-10-05 [expired: 2001-10-04]
uid               [ expired] Linus Torvalds <[email protected]>

Apparently this key is distributed without a sub key. My own public key looks like this (anonymized for posting purposes).

pub   4096R/96Q1DUTLHW3NHA97 2014-10-27 [expires: 2015-03-11]
uid               [ unknown] First Name Last Name <[email protected]>
sub   4096R/96Q1DUTLHW3NHA96 2014-10-27 [expires: 2015-03-11]

Why would people distribute their public key with a sub-key and what are the advantages of doing that or not doing that?

Improve this question
2
  • 1
    Maybe 15 years ago Linus and/or the program he used wasn't perfect? If you check the keyserver (at least subkeys.pgp.net which my gpg uses) you should find 76E21CBB [email protected] from 2005 and 00411886 [email protected] from 2011 each with subkey for encryption.
    – dave_thompson_085
    Oct 30, 2014 at 16:19
  • @dave_thompson_085, thank you for your response to my question. My question is specifically about Torvalds' old key, but why most people share several keys with those specific features (i.e. a sub-key for encryption and a public key for signing and for creating a certificates).
    – Eric Fail
    Nov 3, 2014 at 13:13

2 Answers 2

Reset to default
3

Advantage of Using Subkeys

Using subkeys has the main advantage that in case you have to revoke them, you're not losing all reputation in the web of trust do not have to exchange new keys with other participants you're communicating with.

For example, if you stored your subkeys (and your public primary key, not your secret primary key!) on a mobile phone which you lost, you can easily revoke this subkeys and create a new key pair; all others just have to fetch your updated primary key to get aware of them (and possibly don't even realize).

If you had put your primary key on your mobile, you had to issue a completely new set of keys, get everybody aware of them and start again in the web of trust (having all certifications lost).

Algorithm Choice

Another reason for subkey usage are algorithmic limitations. While RSA can be used for both signing (certifying) and encrypting, and you don't have to use subkeys for encryption, some algorithms are only capable of one of those. For example, DSA (Digital Signature Algorithm) can only be used to issue signatures and requires another algorithm for encryption, usually ElGamal is used here (which again cannot be used for signing).

Further Information

At least GnuPG automatically creates subkeys

In generally recommend reading Debian's discussion of subkeys, I also answered a slightly related question. Finally, have a look at the offline key section of this answer.

Improve this answer
2
  • Thank you for your careful response, it's a good explanation of the relationship between the primary key and sub-keys. I also read Debian's discussion of sub-keys and your related answer. I realize that my question might not have been specific enough. What I'm puzzled by is why I should share more than one public key. The way Torvalds' public key is shared seems to me to be enough (as illustrated in my original question above, 956EB7BF449FA3AB). What I don't understand is; why would anyone be interested to share a sub-key in addition to the public key? Most people seem to be doing this.
    – Eric Fail
    Oct 29, 2014 at 19:15
  • Because (1) some algorithms might require it, and (2) it reduces the hassle of revoking keys if necessary. Most people will stick with one single active subkey pair for signing and encryption, and only use the primary key for certification and key management. Usually, people exchange their subkeys all few years, but stick a longer time with their primary key.
    – Jens Erat
    Oct 29, 2014 at 21:52
1

Usually when generating keyrings the program will generate both an encryption key and a signature key in the public keyring. If you run gpg --edit-key KEYID it will probably show usage: SC and usage: E for your key and subkey respectively.

Improve this answer
6
  • Thank you for responding to my question. I didn't know about these usage: categories. I looked at the usage for the keys listed in my example and Torvalds' 449FA3AB has the E flag. While my keys HW3NHA97 and HW3NHA96 has the usage flags SC and E respectively. In some ways this only puzzles me further. Why would I publish a public key with the SC usage (if I understand it correct this key, the SC key, can be used for signing and for creating a certificates)? (@JensErat )
    – Eric Fail
    Oct 29, 2014 at 19:53
  • Generally speaking you'll want to both sign and encrypt your messages, hence the default behaviour of generating a signing key and encryption when running gpg --gen-key.
    – Tim Lamballais
    Oct 30, 2014 at 10:07
  • This might also provide some extra insight: security.stackexchange.com/questions/1806/…
    – Tim Lamballais
    Oct 31, 2014 at 15:32
  • I understand that I want to sign and encrypt messages, but why would the recipient need the SC key? Maybe a use-scenario, or a tutorial, is spelled out somewhere (I did read the question you linked to, thanks).
    – Eric Fail
    Nov 3, 2014 at 13:20
  • How do you propose the recipient of a message verify your signature without access to your public signing key? Just to be clear, signing/signature verification also works with an asymmetrical private/public keypair.
    – Tim Lamballais
    Nov 3, 2014 at 16:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .