1

I have a DSA/ElGamal 1024/2048 OpenPGP key and want to migrate to a stronger set. I see two options but I'm unsure which is smarter.

  1. keep DSA 1024 masterkey, generate 4096 RSA subkey
  2. ditch the whole thing and generate a brand new pair

The payoff is definitely trust (keeping the old signatures) versus security (strong master key). I can't say which outweighs.

When keeping the old DSA masterkey, is it possible to generate an additional new key for signatures?

  • 1
    You can sign your new key with the old key in order to establish a chain of trust between the two. If the user IDs are very similar or even identical, that's a pretty strong statement. – a CVn Jul 28 '16 at 14:13
1

The payoff is definitely trust (keeping the old signatures) versus security (strong master key). I can't say which outweighs.

If you continue using the old DSA primary key, all messages encrypted for the new RSA subkey will not be in danger when your DSA key is compromiseds, nor are signatures issued by a new signing subkey. Given usable subkeys are available, they will be used for "day to day" work. The primary key is only used for certification and key management tasks in this case.

This means that an attacker could create new subkeys (which might be automatically picked up for encryption and issue valid signatures, of course!) and revoke the old ones, he could issue certifications, but he cannot read messages encrypted to the RSA subkeys you generated.

I'd go for the second scenario, create a new key pair and issue a certification from your old to your new key. After a time and getting some new certifications on your new key, ditch the old one by revoking it. Consider sending a key transition statement.

When keeping the old DSA masterkey, is it possible to generate an additional new key for signatures?

You can of course add a new signing subkey, but not a subkey for issuing certifications (signatures on keys).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.