6

I am thinking about starting again with a new master key. My current master key was not compromised, but I had stored it on my private server temporarily, which is against good practices (but I am the only one who can access this server and the key is protected with a very strong passphrase).

Assuming I want to move to a new master key, is there a way I can tell the world that I want to deprecate my old key, e.g. by "promoting" a subkey, or by signing my new master key with my old one? Or should I just revoke my old key, make a new one, and start re-building my reputation from scratch?

Improve this question

1 Answer 1

Reset to default
4

There is no way to change your primary OpenPGP key without losing incoming certifications. When you create a new one, and you will loose your reputation in the web of trust.

What you can do to keep as much of it:

  • Sign your new key with the old one, so others could follow the signatures. They can still do (manually) when you revoked your old key, at least it is an indication on what was going on if somebody really cares.
  • Sending a key transition statement to those that signed your old key; some of them might also sign your new one.
  • Getting your new key signed, ie. go to key signing parties.
  • Do not revoke the old key immediately, but only after some time when you already received a bunch of new certifications.

Given you do not expect your key to be compromised, you could also consider just watching it (which you should be doing anyway). Especially if your primary key has only certification capability, not a lot of "invisible" damage could be done -- no messages are encrypted for this key, no signatures on documents and messages can be issued.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .