What are the consequences of revoking OpenPGP subkeys and generating new ones?

Question

I almost feel stupid for asking this, but I have some trouble understanding subkeys, and what to do if a subkey gets compromised.

Let's say my "main" private key is used for certification only. I created separate subkeys for signing, encryption, and authentication.

The "main" private key is stored in a vault, and I have the subkeys on my laptop for daily usage.

Now, let's say my laptop gets stolen. I create a revoke request for those subkeys, and create new encryption, signing, and authentication subkeys.

Now, this where I get confused:

• What happens to my existing public key? Do I need to export my public key again, and have it signed by trusted partners again?
• Can messages signed by the new signing subkey, be validated by the public key I already distributed in the past?

Answer 1

What happens to my existing public key? Do I need to export my public key again, and have it signed by trusted partners again?

By revoking the subkeys but not the primary key, you do not have to collect new certifications (each certification points to a pair of a user ID and primary key, subkeys are not relevant with respect to certificatoins).

As you revoked the subkeys and generated new ones, you should distribute a new copy of your public key (which in this case is considered a collection of primary key and subkeys (including the revocation certificates for the old subkeys), user IDs, certifications, ... Your actual public primary key is not updated during this process, though.

Can messages signed by the new signing subkey, be validated by the public key I already distributed in the past?

No, others have to fetch a new copy of your keys. They do not need to validate your primary key again, though.