I’ve read GNU Privacy Handbook, the FAQ and thought I understood the purpose of all four keys initially generated with --gen-keys. But then I found this https://wiki.debian.org/subkeys and lost it.
tl;dr: There is suggested backup of ~/.gnupg, creation of a new pair of subkeys for signing, then all public keys and secret subkeys are exported, master key (for signing) is removed (but still available in backup) and finally public keys along with secret keys are imported back. This is suggested — as far as I understand — in order to keep the original master key for signing in a secret place, because master signing key = my genuine identity. But. Which public keys should be uploaded to the keyserver? Other people may verify your signature and encrypt files for you only if they have corresponding public keys (of yours). But what about gathering signatures of other people on your own public key? Should I upload public key of my master signing key along with the public key of the subordinate keypair I am planning to use daily? If not, what is the purpose of the public part of the master keypair? If I will not upload it, how other people will verify signatures I made on their keys or my own keys? Does it all mean I need at least three public keys to be known to other people — two for daily signing and encrypting and one to verify master key signatures? Do they even need to verify what I sign with my master key (I mean my keys and their keys)? I don’t get the bond between master keys and subordinate keys. Does it even exist? To me they look like totally different keys. Okay, when I usually sign files with key AAAAAAAA when I send them to Alice, and eventually I want to sign her key (…which of her keys, actually? The one she uses daily or the one she keeps like me? If she keeps it, how did it get to me? Which public keys supposed to collect signatures of other people — of the master one or newly created subordinate one?), I need to use my master key BBBBBBBB. How does she know that BBBBBBBB is also my key if they have different IDs? (Let’s assume public key of the master pair is irrelevant, and signing pubkey exchange is done via subordinate pair which never expires.) Sorry for my English.
_______________________________________________ Gnupg-users mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnupg-users
