4

When I initially set up PGP, PGPTools didn't prompt me to create separate subkeys, as explained in the article "Creating the Perfect PGP Keypair". Now that I've learned a bit more about PGP, I'd like to transition to using subkeys properly. But I don't want all of my emails which I signed previously to no longer be valid. What's the proper way to transition to having multiple subkeys under the main key while keeping prior communications valid?

1

You should be able to add the additional subkeys to your master key pair, while still leaving the master keys intact. It doesn't matter if the "master keys" have been used for a while, you don't have to generate new master keys to add subkeys to it.

You linked to the article I usually recommend which describes this process, of using gpg --edit-key <key>, and then addkey. Once you have generated the subkeys, hide the private half of the master key in a safe place and just use the subkeys from now on (only bringing them out for "special occasions" such as singing other people's keys, revoking, or adding new UIDs or subkeys).

I don't want all of my emails which I signed previously to no longer be valid.

That won't be a problem; old emails should still show up nice and signed. The only way old emails that you signed previously can become invalid is if your master key that you signed them with gets revoked or expires. So long as the new signing keys are subkeys of your old keys, anything you sign with the subkeys will still show up as being signed by "your" key.

Encryption on the other hand might be a bit trickier. If you have used your master keypair for encryption in the past, you will still be able to decrypt your old messages, but you will have to fish out your master secret key from its safe place every time you do so.

0

I would create a separate pair. The 1st key should be kept offline, or there isn't much use in having subs....though you must go to the offline machine to sign any keys you get from someone else, then bring them back to the online system.

I haven't messed with a personal HSM (Yubikey), but that may be able to ease the pain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.