4

I recently transitioned to a new OpenPGP key, not because my old one was compromised, but because current best practices demand a longer key length. I signed my old key with my new key, which goes some way towards preserving my place in the existing Web of Trust.

Are there any advantages or disadvantages to using the new key to re-sign the third-party keys I previously signed with the old key? These third-party keys are still reachable from mine in the Web of Trust, by virtue of my having signed my old key with my new key, but wouldn't re-signing them make them slightly more reachable by others, by decreasing the overall path length?

If I do re-sign the keys, is it important to manually verify the fingerprints all over again, just in case the key has been lost or compromised? Or is it acceptable to re-sign by default?

1 Answer 1

1

Are there any advantages or disadvantages to using the new key to re-sign the third-party keys I previously signed with the old key? These third-party keys are still reachable from mine in the Web of Trust, by virtue of my having signed my old key with my new key, but wouldn't re-signing them make them slightly more reachable by others, by decreasing the overall path length?

If you revoke your old key (after some time), you will lose a lot of connections into the web of trust if not signing other keys again.

Whether you want to sign them again or not in the end depends on your own policy. There is no ruling on this, the OpenPGP specification does not even mention specific rules on issuing certifications.

If I do re-sign the keys, is it important to manually verify the fingerprints all over again, just in case the key has been lost or compromised? Or is it acceptable to re-sign by default?

By looking on the fingerprints, you will not be able to decide whether a key has been lost of compromised: you'd have to get in touch with the key holder again. Whether you want to do this additional effort is up to you. GnuPG will restrain from signing revoked keys, anyway (be sure to update them before signing). On the other hand, issuing a new certification might be considered a new statement "I am sure about the keyholder's identity" and is connected with a timestamp: are you still sure about how you verified the identity, which user IDs you selected for signing (you can look this up) and why (this will get more difficult)?

I would not care about verifying fingerprints, but instead using the fingerprints to reference other's keys directly. Such a list can be derived by a simple script and can be directly used to sign keys, caff might provide an easier interface for this.

Personally, I'd only care about signing people I know well and care about.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .