Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I saw a PGP/GPG key of a dude on the internet with different sub-keys. The reason is that when one sub-key expires, he creates a new one.
Now, from a security protective, is it better to create a new key-pair every time or create a sub-key.
What I want to achieve is that no one impersonate me with a fake key-pair.
I like explanation in this article on the Debian site.
Primary keys are extremely important:
Subkeys make key management easier ... [primary key] is the best proof of your identity online ... if you lose it, you'll need to start building your reputation from scratch. If anyone else gets access to your private primary key or its private subkey, they can make everyone believe they're you ...
That's why:
You should keep your private primary key very, very safe ... You should keep your private primary key very, very safe. However, keeping all your keys extremely safe is inconvenient: every time you need to sign a new package upload, you need to copy the packages onto suitable portable media, go into your sub-basement ...
It is very inconvenient. But ...
Subkeys make this easier ... you keep those on your main computer ... You will need to use the primary keys only in exceptional circumstances ...
TLDR: Permanent usage of primary keys requires extreme security measures, which makes the usage inconvenient. Subkeys allow to reduce the risks and at the same time to keep usage at convenient level. The risks are reduced A) by limited validity of the keys, and B) by possibility to revoke them at any time if you suspect they were compromised.
