If I decided today get new subkeys because I simply want to rotate them or because they are about to expire, do I have to sign all keys of other people I signed with my old signing key again? And if I let my subkeys expire, does that have the same effect as if I revoked them?


Short answers:

  1. Adding or revoking signing or encryption subkeys does not affect signatures on your public key.
  2. Revoking a subkey or letting it expire will have the same effect of marking that subkey invalid for all users.

Longer answers:

  1. Technically, your entire PGP key consists of subkeys, but the certification ("C") subkey is considered the backbone of your PGP identity and is often referred to as the "primary" key. When you give out your public key to others, it's the fingerprint of the "C" subkey that you pass around. The "C" subkey is used to cross-certify other keys -- either your own subkeys, or public keys belonging to others. If you add or revoke any signing ("S") or encryption ("E") subkeys, this will not affect the signatures on your "C" subkey, and therefore your cross-certification data is not impacted by subkey changes.

  2. In general, PGP will only care whether a subkey is "valid" or "invalid". Expired or revoked keys will be equally treated as "invalid", and it's up to the UI to display the reason behind it ("expired" vs. "revoked"). Actively revoking subkeys requires that you republish your public key and convince your correspondents to apply the updates. There is no universally established mechanism for receiving timely key updates, so many users choose to create shorter-lived subkeys that will force their correspondents to refresh the entire key when the subkey expires ("passive nudge") instead of creating long-lived subkeys and then notifying everyone to fetch key updates in case of key revocation ("active nudge").

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.