Do I need to revoke both my OpenPGP primary key and subkey?

Question

After creating an OpenPGP key pair in GnuPG, if I list keys with gpg --list-keys, I get (GnuPG default):

/someone/.gnupg/pubring.gpg
------------------------
pub   2048R/BC589B05 2015-07-15
uid                  Some One
sub   2048R/3dd81C42 2015-07-15

Consisting the primary public key with ID BC589B05, and sub key with ID 3dd81C42.

Is it necessary to create a revocation certificate for each of these, or just the pub key? In especially, is it sufficient to just do

gpg --gen-revoke BC589B05 > BC589B05.revoke.asc

and backup BC589B05.revoke.asc somewhere, or am I supposed to repeat this for the sub key, too?

Answer 1

Revoking the primary key is sufficient. OpenPGP clients will refuse to use subkeys of revoked primary keys. Revoking primary and subkeys is different: primary key revocations are special self-certifications (self-signatures) containing revocation information, while subkey revocations are issued by the primary key they belong to.

Using GnuPG, it is not possible to generate a revocation certificate for subkeys anyway. From man gpg:

--gen-revoke name

   Generate a revocation certificate for the complete key. To revoke a
   subkey or a signature, use the --edit command.