What are the advantages to OpenPGP "subkeys"?

Question

I'm trying to get started with OpenPGP encryption. I understand the concept of keeping your master key safe, and using other keys signed by that key (which can be revoked if stolen) for encryption and other daily use. But I'm confused by the implementation of subkeys specifically. Can't this be done easily without the concept of subkeys? Do subkeys really make it easier? Specifically, the Debian wiki says:

Subkeys are like a separate key pair, but automatically associated with your main key pair.

As far as I can tell, "associated with" here just means that they're automatically grouped together in the UI, for user convenience, but I could achieve the same security by simply creating additional key pairs separately, and signing them with my first key. Is this correct?

The wiki goes on:

The master key pair is quite important.... You should keep your private master key very, very safe. However, keeping all your keys extremely safe is inconvenient...

Subkeys make this easier.... You will use the subkeys for decrypting and signing messages.... You will need to use the master keys only in exceptional circumstances.

So... the purpose of subkeys is to encourage the user to create separate keys for separate purposes, and store and use them separately?

But the UI of GnuPG and several key management GUIs I've used does exactly the opposite of this. It groups keys with their subkeys, assumes by default that you want to copy or move them together, and doesn't always make it clear which key in a set is being used. An entirely separate key would be more suited to this purpose than a subkey, wouldn't it?

Am I missing something? Why are subkeys "automatically associated with your main key pair" - and quite strongly associated, at that - if their purpose is to encourage the user to dissociate them from their main key pair?

Answer 1

As far as I can tell, "associated with" here just means that they're automatically grouped together in the UI, for user convenience, but I could achieve the same security by simply creating additional key pairs separately, and signing them with my first key. Is this correct?

Consider an OpenPGP (primary) key an identity, linking together user IDs, subkeys and certifications. If people want to communicate with you, they select this primary key, and will not have to care about any further details.

If you ready the OpenPGP specification closely, you will realize the implementation of the Subkey Binding Signature 0x18 is very close to what you described: you generate another key pair (which for subkeys is designated as such, but otherwise not very different from primary keys), and bind it to the primary key using a signature (but a special one, that is defined as binding the subkey).

By not using multiple primary keys and "normal" signatures, OpenPGP allows you to pretty much hide the details behind subkeys. For normal use, it does not matter whether a subkey changed. If you care, you can have a closer look at the key and its subkeys, but you don't have to.

So yes, you can achieve the same security with separate keys -- but losing much of the convenience and ease of use of subkeys.

But the UI of GnuPG and several key management GUIs I've used does exactly the opposite of this. It groups keys with their subkeys, assumes by default that you want to copy or move them together, and doesn't always make it clear which key in a set is being used. An entirely separate key would be more suited to this purpose than a subkey, wouldn't it?

Indeed, the user interface often lacks here. But be aware that using offline primary keys is already very advanced usage of OpenPGP/GnuPG, and without some knowledge of OpenPGP and the tools you're using, you'll get into trouble using such keys, anyway.

For creating such a key, you'd usually just move out the whole GnuPG home directory, which you will keep especially safe and offline. Generate subkeys as required, and export those subkeys using gpg --export-secret-subkeys [subkey-id]! (you can also define multiple of them). Be aware of the exclamation mark ! after the key ID, otherwise GnuPG will resolve the key ID to the primary key's ID! Import the exported secret key to your day-to-day GnuPG home directory.

Think of this as a trade between easier key handling for the key's owner (taking advantage of advanced OpenPGP features) and easier key handling for other users (which will often be less confident with the technology in use).

Answer 2

Put aside the terminology and the choice of the words, I like thinking of subkeys as guarantor of isolation and making the parallel with what we do today with passwords on the net:

• you register to some random website, you have a password manager that generates you a password for that specific website. You don't really care about the exact password, and if the website gets compromised for some reason, only that website is affected (the trust context is scoped)
• the password manager is kept private and safe, with a strong password. Every password is derived from it.

Well, GPG master keys and subkeys are a bit like this:

• the master key is a bit like your identity and from the above, acts as the password manager. You loose it, you loose all. Every subkey is derived from it
• the subkey is for use in a specific trust context, for instance a computer, a software etc. When the host is compromised, only that subkey is compromised.

Historically the manipulation of sukeys is made very difficult, almost hidden by the nowadays tools, and you have to perform various operations to use them properly. Also the choice of the subkey is counter productive. However I believe subkey should be really first citizen and their use widely spread.