6

Many people advocate generating new primary keys for each identity they wish to have. For example, creating one primary key and associated subkeys for workplace use, and a completely different primary key and associated subkeys for personal use.

But is it possible to generate one primary key, and create multiple subkeys that can each have their own unique UIDs for whatever purpose you desire? For example, I create two subkeys (one for signing, one for encryption) for work, setting their UID's appropriately, and another two for personal use? Is it even possible for sets of subkeys to be completely distinct from one another when they come from the same parent primary key? Would there be a benefit to this configuration? I've been using GnuPG for a while, and the UID aspect of keys has always confused me.

6

Consider a single primary key to be equivalent to one identity.

You cannot connect subkeys to user IDs. Both subkeys and user IDs are attached to the primary key, the only connection from user IDs to subkeys is through the primary key.

If you want to select different subkeys for different machines (for example at home and at work), this is easily possible for signing (simply only put one signing subkey on each machine), but again it would not be connected to a specific user ID (but to the primary key).

For encryption, there is no such way, a sender's OpenPGP implementation will usually just choose the newest key (and maybe offer a choice to select a specific key).

Use multiple cross-signed primary keys instead, if you want to separate concerns.

  • Thanks for highlighting my confusion. Since I can't create multiple identities off one key, is it possible to lend some credibility to one of my keys by signing it with another one? Suppose my personal key has lots of credibility (by whatever means, signatures, etc.). Can I lend some credibility to my work key by signing it with my personal key (if I didn't care about mixing up those identities?). Is this what is normally intended by signing keys? – Yankee Jun 29 '15 at 7:40
  • Yes, this is possible (that's why I proposed cross-signing the keys). But this will only work if the other side uses the web of trust features (ie. puts trust on your "credible" key). – Jens Erat Jun 29 '15 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.