The Stack Overflow podcast is back! Listen to an interview with our new CEO.
4 added 22 characters in body
source | link

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The subkeys are 4096 bits. This setup works well, but I wanted to improve security so I got a Yubikey Neo.

Because the Yubikey only supports 2048 bit keys, I generated another pair of subkeys on a secure machine and storeduploaded them onto the Yubikey. Now I have two pairs of encryption and signing subkeys on my keyring. GnuPG will use the newest suitable subkeys automatically, so my earlier set of subkeys is basically redundant.

I keep all the subkeys on my main offline keychain, but I don't want them cluttering up the keychain on my primary portable devices (laptop, etc). My plan is to also rekey the Yubikey often (at least once a year) so I'll have to deal with a growing list of superseded subkeys.

If someone sends data encrypted to one of my old subkeys, I'll have to dig out the offline keyring in order to decrypt it. This is quite a pain and I'd rather avoid doing so.

What's the best strategy for discontinuing use of old but still uncompromised subkeys? Revoke them? Set a short expiration date and wait for them to expire?

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The subkeys are 4096 bits. This setup works well, but I wanted to improve security so I got a Yubikey Neo.

Because the Yubikey only supports 2048 bit keys, I generated another pair of subkeys and stored them on the Yubikey. Now I have two pairs of encryption and signing subkeys on my keyring. GnuPG will use the newest suitable subkeys automatically, so my earlier set of subkeys is basically redundant.

I keep all the subkeys on my main offline keychain, but I don't want them cluttering up the keychain on my primary portable devices (laptop, etc). My plan is to also rekey the Yubikey often (at least once a year) so I'll have to deal with a growing list of superseded subkeys.

If someone sends data encrypted to one of my old subkeys, I'll have to dig out the offline keyring in order to decrypt it. This is quite a pain and I'd rather avoid doing so.

What's the best strategy for discontinuing use of old but still uncompromised subkeys? Revoke them? Set a short expiration date and wait for them to expire?

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The subkeys are 4096 bits. This setup works well, but I wanted to improve security so I got a Yubikey Neo.

Because the Yubikey only supports 2048 bit keys, I generated another pair of subkeys on a secure machine and uploaded them to the Yubikey. Now I have two pairs of encryption and signing subkeys on my keyring. GnuPG will use the newest suitable subkeys automatically, so my earlier set of subkeys is basically redundant.

I keep all the subkeys on my main offline keychain, but I don't want them cluttering up the keychain on my primary portable devices (laptop, etc). My plan is to also rekey the Yubikey often (at least once a year) so I'll have to deal with a growing list of superseded subkeys.

If someone sends data encrypted to one of my old subkeys, I'll have to dig out the offline keyring in order to decrypt it. This is quite a pain and I'd rather avoid doing so.

What's the best strategy for discontinuing use of old but still uncompromised subkeys? Revoke them? Set a short expiration date and wait for them to expire?

3 The question is generally valid for OpenPGP.
source | link

Best practice of deprecating old GPGOpenPGP subkeys when migrating to a new subkey pair?

I've been using GPGGnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The subkeys are 4096 bits. This setup works well, but I wanted to improve security so I got a Yubikey Neo.

Because the Yubikey only supports 2048 bit keys, I generated another pair of subkeys and stored them on the Yubikey. Now I have two pairs of encryption and signing subkeys on my keyring. GPGGnuPG will use the newest suitable subkeys automatically, so my earlier set of subkeys is basically redundant.

I keep all the subkeys on my main offline keychain, but I don't want them cluttering up the keychain on my primary portable devices (laptop, etc). My plan is to also rekey the Yubikey often (at least once a year) so I'll have to deal with a growing list of superseded subkeys.

If someone sends data encrypted to one of my old subkeys, I'll have to dig out the offline keyring in order to decrypt it. This is quite a pain and I'd rather avoid doing so.

What's the best strategy for discontinuing use of old but still uncompromised subkeys? Revoke them? Set a short expiration date and wait for them to expire?

Best practice of deprecating old GPG subkeys when migrating to a new subkey pair?

I've been using GPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The subkeys are 4096 bits. This setup works well, but I wanted to improve security so I got a Yubikey Neo.

Because the Yubikey only supports 2048 bit keys, I generated another pair of subkeys and stored them on the Yubikey. Now I have two pairs of encryption and signing subkeys on my keyring. GPG will use the newest suitable subkeys automatically, so my earlier set of subkeys is basically redundant.

I keep all the subkeys on my main offline keychain, but I don't want them cluttering up the keychain on my primary portable devices (laptop, etc). My plan is to also rekey the Yubikey often (at least once a year) so I'll have to deal with a growing list of superseded subkeys.

If someone sends data encrypted to one of my old subkeys, I'll have to dig out the offline keyring in order to decrypt it. This is quite a pain and I'd rather avoid doing so.

What's the best strategy for discontinuing use of old but still uncompromised subkeys? Revoke them? Set a short expiration date and wait for them to expire?

Best practice of deprecating old OpenPGP subkeys when migrating to a new subkey pair?

I've been using GnuPG with an offline master + online subkey setup for a while now. All my email is signed with the signing-only subkey and encryption is done with the encryption-only subkey. The subkeys are 4096 bits. This setup works well, but I wanted to improve security so I got a Yubikey Neo.

Because the Yubikey only supports 2048 bit keys, I generated another pair of subkeys and stored them on the Yubikey. Now I have two pairs of encryption and signing subkeys on my keyring. GnuPG will use the newest suitable subkeys automatically, so my earlier set of subkeys is basically redundant.

I keep all the subkeys on my main offline keychain, but I don't want them cluttering up the keychain on my primary portable devices (laptop, etc). My plan is to also rekey the Yubikey often (at least once a year) so I'll have to deal with a growing list of superseded subkeys.

If someone sends data encrypted to one of my old subkeys, I'll have to dig out the offline keyring in order to decrypt it. This is quite a pain and I'd rather avoid doing so.

What's the best strategy for discontinuing use of old but still uncompromised subkeys? Revoke them? Set a short expiration date and wait for them to expire?

2 clarification
| link

What to do with Best practice of deprecating old GPG subkeys when migrating to a new subkey pair?

1
source | link