3

I'm trying to get started with OpenPGP encryption. I understand the concept of keeping your master key safe, and using other keys signed by that key (which can be revoked if stolen) for encryption and other daily use. But I'm confused by the implementation of subkeys specifically. Can't this be done easily without the concept of subkeys? Do subkeys really make it easier? Specifically, the Debian wiki says:

Subkeys are like a separate key pair, but automatically associated with your main key pair.

As far as I can tell, "associated with" here just means that they're automatically grouped together in the UI, for user convenience, but I could achieve the same security by simply creating additional key pairs separately, and signing them with my first key. Is this correct?

The wiki goes on:

The master key pair is quite important.... You should keep your private master key very, very safe. However, keeping all your keys extremely safe is inconvenient...

Subkeys make this easier.... You will use the subkeys for decrypting and signing messages.... You will need to use the master keys only in exceptional circumstances.

So... the purpose of subkeys is to encourage the user to create separate keys for separate purposes, and store and use them separately?

But the UI of GnuPG and several key management GUIs I've used does exactly the opposite of this. It groups keys with their subkeys, assumes by default that you want to copy or move them together, and doesn't always make it clear which key in a set is being used. An entirely separate key would be more suited to this purpose than a subkey, wouldn't it?

Am I missing something? Why are subkeys "automatically associated with your main key pair" - and quite strongly associated, at that - if their purpose is to encourage the user to dissociate them from their main key pair?

3

As far as I can tell, "associated with" here just means that they're automatically grouped together in the UI, for user convenience, but I could achieve the same security by simply creating additional key pairs separately, and signing them with my first key. Is this correct?

Consider an OpenPGP (primary) key an identity, linking together user IDs, subkeys and certifications. If people want to communicate with you, they select this primary key, and will not have to care about any further details.

If you ready the OpenPGP specification closely, you will realize the implementation of the Subkey Binding Signature 0x18 is very close to what you described: you generate another key pair (which for subkeys is designated as such, but otherwise not very different from primary keys), and bind it to the primary key using a signature (but a special one, that is defined as binding the subkey).

By not using multiple primary keys and "normal" signatures, OpenPGP allows you to pretty much hide the details behind subkeys. For normal use, it does not matter whether a subkey changed. If you care, you can have a closer look at the key and its subkeys, but you don't have to.

So yes, you can achieve the same security with separate keys -- but losing much of the convenience and ease of use of subkeys.

But the UI of GnuPG and several key management GUIs I've used does exactly the opposite of this. It groups keys with their subkeys, assumes by default that you want to copy or move them together, and doesn't always make it clear which key in a set is being used. An entirely separate key would be more suited to this purpose than a subkey, wouldn't it?

Indeed, the user interface often lacks here. But be aware that using offline primary keys is already very advanced usage of OpenPGP/GnuPG, and without some knowledge of OpenPGP and the tools you're using, you'll get into trouble using such keys, anyway.

For creating such a key, you'd usually just move out the whole GnuPG home directory, which you will keep especially safe and offline. Generate subkeys as required, and export those subkeys using gpg --export-secret-subkeys [subkey-id]! (you can also define multiple of them). Be aware of the exclamation mark ! after the key ID, otherwise GnuPG will resolve the key ID to the primary key's ID! Import the exported secret key to your day-to-day GnuPG home directory.

Think of this as a trade between easier key handling for the key's owner (taking advantage of advanced OpenPGP features) and easier key handling for other users (which will often be less confident with the technology in use).

  • "Consider an OpenPGP (primary) key an identity, linking together user IDs, subkeys and certifications. If people want to communicate with you, they select this primary key, and will not have to care about any further details." But the primary key is for signing only - if people want to communicate with me, don't they have to use my encryption subkey? Or do you mean that their software will automatically choose the right subkey for them when they select my primary key? (Assuming I have only 1 encryption subkey.) – Josh Feb 18 '16 at 1:13
  • "Be aware that using offline primary keys is already very advanced usage of OpenPGP/GnuPG, and without some knowledge of OpenPGP and the tools you're using, you'll get into trouble using such keys, anyway." Can you give some examples of trouble you can get into using offline primary keys? (Other than losing them, obviously. And assuming that I created a signing sub-key for day-to-day use in addition to the encryption subkey, so I only use the primary key for certification.) – Josh Feb 18 '16 at 1:20
  • Yes, when "using" the primary (non-encryption) key, an appropriate encryption subkey is automatically chosen. Usually the newest key is chosen. Apart from GnuPG before version 2.1, where merging secret keys was a real hassle, I don't see any trouble in using offline keys -- but you need some understanding how subkeys and primary keys are related. – Jens Erat Feb 19 '16 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.