1

I have a PGP master public / private key pair. I have created 3 subkeys for it. I want to add 3 more subkeys to this master key. Would doing so change my public and private keys?

2

No.

Your quesiton is quite scarce in details, so I will assume that you are talking about PGP keys. And for change a definition such as if that would lead to a key with a different fingerprint.

If you add a new subkey to an existing PGP key:

  • the fingerprint of your key stays the same (it is the master key)
  • existing signatures on your key are not lost
  • the public key is augmented with the new subkey (and the signature binding it), so people that already have your public key will need to reimport/refresh it in order to get the new subkey.
  • similarly, in order to work with the new private subkey (eg. if you used it on several PCs), you will need the private part imported.
  • So to clarify my public master key is what I provide (say on my website). And that can be used to verify messages I send and encrypt messages sent to me. Any one of the encryption subkeys that haven't been revoked (and are represented in the master public key) can be used to decrypt messages? What is confusing is SSH. How is that tied into the master key? And if the master key revokes the SSH key would it still gain access to a server? – bkabbott Jun 8 at 2:36
  • You provide your public key (people will download the public part of the master key, as well as the public part of the subkeys, the signatures, etc.) This is what you get when exporting the key. And indeed that can be used to verify messages you send and encrypt messages sent to you. – Ángel Jun 8 at 23:32
  • The encryption software will choose for encryption one of the encryption subkeys that haven't been revoked and are represented in the master public key. You need the private part of that subkey in order to decrypt the messages. The normal thing is to have only one encryption subkey (not revoked or expired). – Ángel Jun 8 at 23:34
  • If you want to use a PGP key for ssh, you would use a subkey enabled for authentication. It would be tied to the master key in the same way as other subkeys (with a signature from the master key). – Ángel Jun 8 at 23:52
  • As for using a PGP key for ssh, there are two ways you could be doing it: (a) by copying into the authorized_keys the public part of the subkey. Here you are using your PGP key, but it's actually working as a standalone key from sshd point of view. (b) You are using the mmonkeysphere to link the users to their keys. In the later case the user should no longer have access to the server after revocation once it knows about it, note that the server will need to refresh its knowledge of the keys periodically in order to discover that. – Ángel Jun 9 at 0:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.