Am 2017-08-30 09:01, schrieb Marc Haber:
On Tue, Aug 29, 2017 at 04:07:45PM -0300, Henrique de Moraes Holschuh wrote:The **public** portion of *every* key (master and all subkeys) go into the public keyrings and also in the Debian keyring. gnupg will handle this automatically if you use "--export" (do *NOT* confuse with a different export option that is for private keys).So it is probably a bad idea / impossible (?) to have a dedicated signing-only key used for Debian that guared more closely than the "regular every-day" key?
Well, you could create a completely separate key pair (with a separate master key) for Debian purposes only.
People keep mentioning to store the private key on a LUKS-encrypted device. Why? Is the private key encryption that happens inside GnuPG itself when you protect your private key with a passphrase not sufficient?
Defense in depth. First of all, it's not immediately clear that the media I keep my private key on is actually the one that contains my private key (_all_ external media I have at home is LUKS encrypted, except for a couple of USB sticks I use to share data with other people), and secondly I use a different passphrase for LUKS as compared to the private key. (The tricky thing here is making sure you don't forget the second passphrase, otherwise you're screwed.) Basically, it's an added level of paranoia.
Only the public keys (all of them: master and subkeys). gnupg will handle this automatically if you use --send-key.And I hope that it's really hard to fuck up here and to send private keys to the keyserver.
I don't think that's possible with GnuPG command line, as far as I know GnuPG will only ever send public keys to the keyservers. However, you _could_ achieve that if you export the private key manually and accidentally upload that via the web interface that some keyservers provide. ;-) They'll probably reject the upload (because it's not a public key), but who knows where that'll be logged...
I have had people send me the private parts of their ssh keys...
To be fair: SSH's naming convention for files is not the easiest
to understand for new users. Using ${filename} for the private key
and ${filename}.pub for the public key does not make it obvious
that they need to keep ${filename} private. Had they used
${filename}.secret for the private key this might have reduced
such occurrences.
Regards,
Christian
