Skip to main content
Information Security

Return to Question

added 5 characters in body; edited tags; edited title
Source Link
Jens Erat
Jens Erat
  • 24.9k
  • 12
  • 82
  • 103

Does GPGOpenPGP key expiration add to security?

I've created a new GPGOpenPGP key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised or stolen the damage will be limited.

But then I thought about the day when I will need to sign my new key. Signing the new key with the old key seems equivalent to keeping the old key, and thus adds nothing to security.

Does setting an expiration date improve key security? If so, what's the best expiration/key replacement policy?

Does GPG key expiration add to security?

I've created a new GPG key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure because if the key is compromised or stolen the damage will be limited.

But then I thought about the day when I will need to sign my new key. Signing the new key with the old key seems equivalent to keeping the old key, and thus adds nothing to security.

Does setting an expiration date improve key security? If so, what's the best expiration/key replacement policy?

Does OpenPGP key expiration add to security?

I've created a new OpenPGP key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised or stolen the damage will be limited.

But then I thought about the day when I will need to sign my new key. Signing the new key with the old key seems equivalent to keeping the old key, and thus adds nothing to security.

Does setting an expiration date improve key security? If so, what's the best expiration/key replacement policy?

Tweeted twitter.com/#!/StackSecurity/status/559538042931658755
Improve grammar, add tag
Source Link
edit approved Sep 12, 2014 at 2:42
Flimzy
edit approved Sep 12, 2014 at 2:42
Flimzy
  • 696
  • 1
  • 6
  • 14

I've created a new GPG key to sign a software package in a source repository, with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised or stolen - the damage will be limited.

But then I thought about the day when I will need to sign my new key. Signing the new key with the old key seems equivalent to keeping the old key, and thus adds nothing to security.

Does setting an expiration date improvesimprove key security? If so, what's the best expiration\keyexpiration/key replacement policy?

I've created a new GPG key to sign a software package in a source repository, with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised or stolen - the damage will be limited.

But then I thought about the day when I will need to sign my new key. Signing the new key with the old key seems equivalent to keeping the old key, and thus adds nothing to security.

Does setting an expiration date improves key security? If so, what's the best expiration\key replacement policy?

I've created a new GPG key to sign a software package in a source repository with an expiration date three years from now. It seemed like a good security measure because if the key is compromised or stolen the damage will be limited.

But then I thought about the day when I will need to sign my new key. Signing the new key with the old key seems equivalent to keeping the old key, and thus adds nothing to security.

Does setting an expiration date improve key security? If so, what's the best expiration/key replacement policy?

Source Link
Adam Matan
Adam Matan
  • 1.3k
  • 2
  • 11
  • 15

Does GPG key expiration add to security?

I've created a new GPG key to sign a software package in a source repository, with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised or stolen - the damage will be limited.

But then I thought about the day when I will need to sign my new key. Signing the new key with the old key seems equivalent to keeping the old key, and thus adds nothing to security.

Does setting an expiration date improves key security? If so, what's the best expiration\key replacement policy?