10

As I understand it, GnuPG allows the creation of multiple subkeys, but multiple encryption subkeys are problematic because it's not clear which encryption subkey someone should use when sending a message. As such, by default, when a person sends a message to you, their software will select the most recent encryption subkey. This limits the utility of having multiple encryption subkeys on different devices, but not necessarily signing subkeys.

Now, imagine a situation where we have two laptops. Neither laptop contains the master key, but only a single subkey for signing (S) and subkey for encryption (E). Since we have trouble using multiple encryption subkeys, we have a setup like this:

Laptop 1: E, S1
Laptop 2: E, S2

Hence, each laptop has its own signing subkey, but they each share an encryption subkey. Now, say we lose laptop 1. At this point, using the master key, we can revoke the certificate for E and S1. Since the master key was safe, we preserve our WoT. However, since E is no longer valid, we still need to update laptop 2 with a new encryption subkey. Since we always need to update laptop 2 in the case that laptop 1 is compromised, why should we prefer the setup above to a key setup

Laptop 1: E, S
Laptop 2: E, S

Certainly, if we're only signing, having separate signing subkeys for each device makes sense. However, if we need to sign and encrypt, does it still make sense to have separate signing subkeys for each device?

Edit 1

Following up on @jens-erat's answer, I checked and GnuPG does allow us to specify exactly which subkey we use for encryption. Simply, append ! after the specified key. This forces GnuPG to use this particular key and not go through the normal calculation as to what key to use. This is in the man file under the section "HOW TO SPECIFY A USER ID" under subheading "By key Id." Then, as @jens-erat stated, we could add a bunch of notations to the key, which specify which key should be used for which situation or address. By looking at the notation block with --list-sigs and then specifying the exact key with !, we can utilize multiple encrypting subkeys. That being said, I don't think this is standard use and will likely cause use problems for people.

Improve this question

1 Answer 1

Reset to default
4

There are lots of possible use cases.

  • In the example you gave, by only revoking the subkey affected signatures of the other stay unharmed. Often, you will not immediately realize a computer was harmed and you have to put all signatures created in a given time frame in doubt. The other computer stays unaffected.
  • There are use cases that do not require an encryption key, but only signature keys, like code signing on a build server.
  • You might have a less secure, always-online signing key and a more secure offline signing key, for example by using an OpenPGP smart card.
  • And probably some more...

Finally, the lack of possibilities in choosing the subkey to encrypt to is mainly an issue in the software, not the protocol itself (although the standard could make use of some extension for declaring uses like "laptop", "mobile phone"; in a non-standardized way this could be achieved by using the notation packet).

Improve this answer
2
  • 1
    Elaborating on the cases Jeris Eral already mentioned in their answer, the most important use of signing subkeys is for signing other people's keys. Since a key revocation could potentially affect the validity of hundreds of signatures, it's somewhat common to have an offline key just to sign other users keys, so that the web of trust isn't impaired by the fallout from a compromised key.
    – Stephanie
    May 27, 2014 at 18:26
  • Issuing certificates (signing other primary keys) is usually performed using the primary key. On the other hand, at least GnuPG per default creates both encryption- and signing-only subkeys, which are used for day-to-day work. I even think that subkeys even cannot be used to certify other keys, but I cannot find the appropriate statement in the specs right now. Anyway: This is a reason to have one signing subkey, the OPs question was about why to have multiple of them.
    – Jens Erat
    May 27, 2014 at 21:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .