My current GnuPG key schema is the one recommended in OpenPGP Best Practices and many other sources. It consists in one offline master key plus a set of sub-keys for day-to-day operations stored inside an smart card.
My question is, what to do if my smart card gets compromised?
If I understand correctly, I must revoke all sub-keys using revkey
command on the prompt of gpg --edit-key $KEYID
. After that, I must create new sub-keys and export and share again my public key.
- Is this new public key my current public key? My new public key is twice bigger.
- How can I propagate sub-keys revocation to the OpenPGP network?
- What happens with people having my previous public key?
- What if I
delkey
sub-keys afterrevkey
? My new public key changes but keeps a similar size. - If I do the previous step, will sub-keys revocation propagate to the OpenPGP network?