Let's say a user creates their primary gpg key pair for User Name <[email protected]> and selects an encryption and signing algorithm that isn't widely available (think goldilocks). For instance, let's say one would create a signing key with ed448, and encryption key with cv448.

If the user goes ahead and submits such a key certificate to key servers, I would imagine most individuals won't be able to send them encrypted communications or verify their signature. So, a few related questions:

  1. Would adding another encryption subkey for a widely used encryption standard like RSA before submitting the key certificate to keyservers help the situation (more people will be able to encrypt for the user)?

  2. If 1. is true, will gpg automatically choose the strongest encryption algorithm at senders end (depending on if they have goldilocks or just RSA)? Or will the sender have to explicitly specify RSA/goldilocks subkey for encryption or just identify the user with their primary public key?

  3. Similarly, can such a user sign the same data with two different keys (RSA and ed-goldilocks)? Will it be two different certificates or can it be captured in one? Would gpg automatically choose the strongest signature verification algorithm at the recipient's end?

I tried finding answers to these questions but couldn't find anything. Most similar questions are about encryption/signing for multiple different recipients.

  • This is more related to Information Security as most key management questions are handled at Information Security. Do you mind if I migrate it to that site? You need to also sign in there to interact with your question. Here it could be closed as off topic. Mar 10 at 10:47
  • @MaartenBodewes-modelection Sure, thanks for the information! I am new to information security and crypto systems.
    – aackmann
    Mar 10 at 19:33

1 Answer 1


A public key certificate can not be used with an asymmetric cryptosystem other than the one it was originally issued for.

Two reasons:

  1. The certificate contains a description of the cryptosystem intended for the public key, which is verified before use. And the certificate can't be altered to change this information, since the certificate is signed.
  2. The public key itself is intended for a cryptosystem, and can only be used for a closely related cryptosystems. E.g. it's impossible to use a public key for an elliptic curve cryptosystem for a cryptosystem using a different set of of elliptic curve parameters. Even when it's possible to repurpose a public key (e.g. from ECDSA on curve secp256k1 to some Schnorr signature on the same curve, or encryption), it's hard to tell if it would be safe: the security analysis of a cryptosystem typically assumes that it's key is used only per that cryptosystem. And that's why uncontrolled change of usage is made impossible, see first point.

Can (…) a user sign the same data with two different keys (RSA and ed-goldilocks)?

A user can have multiple keys, each certified, and sign with these multiple keys. However, as far as I know, there is no mechanism in GPG/OpenPGP for having a file signed with multiple keys, or have a certificate cover multiple keys. This is technically possible, but the closest I know is that it's possible to concatenate multiple detached signatures or multiple public key certificates into one file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .