2

What is the best way to upgrade an OpenPGP key that was created 11 years ago? It's 1024-bit and is published on the key server.

I can create a new key, but what's the proper way to update the existing public key on the server?

  • What exactly do you want to upgrade/update? – unor Jan 8 '15 at 14:51
2

This question has a duplicate on Super User, where I also provided an answer. As the question is a better fit here and cross-site duplicates are not allowed, I will simply be repeating it here, extending it a little bit.

There is no way to "upgrade" an OpenPGP key. You will have to create a new one, and you will loose your reputation in the web of trust.

Some people I met decided to stick with a RSA 1024 primary key, but use stronger subkeys instead (which is easily possible without losing your reputation in the web of trust), which comes with secure day-to-day use (for encryption/signing documents with your subkeys), but might enable attackers to add and revoke certifications, subkeys and UIDs.

Think about:

  • Signing your new key with the old one, so others could follow the signatures
  • Sending a key transition statement to those that signed your old key; some of them might also sign your new one
  • Getting your new key signed, ie. go to key signing parties
  • Revoking the old one after some time
  • Using a seemingly unnecessary large key as primary key and smaller subkeys for day-to-day usage. You will never need the primary key for anything but signing other keys (which is rare) and others verifying your signatures (cheap anyway).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.