1

I saw a PGP/GPG key of a dude on the internet with different sub-keys. The reason is that when one sub-key expires, he creates a new one.

Now, from a security protective, is it better to create a new key-pair every time or create a sub-key.

What I want to achieve is that no one impersonate me with a fake key-pair.

1 Answer 1

1

I like explanation in this article on the Debian site.

Primary keys are extremely important:

Subkeys make key management easier ... [primary key] is the best proof of your identity online ... if you lose it, you'll need to start building your reputation from scratch. If anyone else gets access to your private primary key or its private subkey, they can make everyone believe they're you ...

That's why:

You should keep your private primary key very, very safe ... You should keep your private primary key very, very safe. However, keeping all your keys extremely safe is inconvenient: every time you need to sign a new package upload, you need to copy the packages onto suitable portable media, go into your sub-basement ...

It is very inconvenient. But ...

Subkeys make this easier ... you keep those on your main computer ... You will need to use the primary keys only in exceptional circumstances ...

TLDR: Permanent usage of primary keys requires extreme security measures, which makes the usage inconvenient. Subkeys allow to reduce the risks and at the same time to keep usage at convenient level. The risks are reduced A) by limited validity of the keys, and B) by possibility to revoke them at any time if you suspect they were compromised.

2
  • Thanks, but then is it fine if I create a key-pair that don't expire, and create yearly sub-keys into it? Commented May 26, 2022 at 2:19
  • Depending on risks, in some cases validity should not exceed 3 months, in other cases 3 years are acceptable. Only you know what risks and what validity is acceptable in your case.
    – mentallurg
    Commented May 26, 2022 at 15:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .