Discussion:
GPG Subkeys
Matt Vance vancematthew1983@yahoo.com [PGP-Basics]
2014-09-25 19:54:28 UTC
Permalink
Hello kind list subscribers,

I recently built trying to learn more about gnupg. From what I have been learning, it's best to use a subkey to sign everything and keep your master secret key offline. I found a couple of good articles online which discuss how to go about doing this (links below). I was able to accomplish this by following the articles, but the process left me with a couple of questions.

1.) As I was following along with one of articles, it had me export my newly generated subkey so I can re-import it after removing my masterkey. I ran gpg --list-secret-keys (and also gpg -K) to determine the keyID associated with my new subkey. However, the output of those commands did not provide any indication as to which key was the encryption subkey and which was the sign only subkey.

The keyID I needed was the last one in the list output of gpg--list-secret-keys (presumably because it was the list subkey generated). I was able to verify this truly was the new signing subkeyID rather than the encryption subkeyID by scrolling further up the shell to see the output of the addkey command. The results of that command showed the "usage" of each keyID. Had I done this at a later time or had multiple subkeys, how can you tell the key type (e.g. encryption, sign, etc.) of subkeys? Is there a command similar to gpg --list-secret-keys which also displays key usage?

2.) One of the steps in the Debian article said "Export the subkeys: gpg --export-secret-subkeys SUBKEYID1! .. SUBKEYIDn! > subkeys (NOTE: The exclamation marks ! are significant)". It said the exclamation after the keyID is important, but does not say why. Nothing I found online discusses ever using an ! after a keyID. The other article does not include this step and running the command without it seemed to work. What does adding an exclamation (!) after a keyID in GPG do?

I'm running the 1.4 branch of GPG.

The URLs for articles I referenced are:
https://alexcabal.com/creating-the-perfect-gpg-keypair/
https://wiki.debian.org/Subkeys?action=show&redirect=subkeys

Thanks in advance for your help.

Matt
'Robert J. Hansen' rjh@sixdemonbag.org [PGP-Basics]
2014-09-25 20:13:49 UTC
Permalink
Post by Matt Vance ***@yahoo.com [PGP-Basics]
I recently built trying to learn more about gnupg. From what I have
been learning, it's best to use a subkey to sign everything and keep
your master secret key offline.
"Best" is a significant overstatement.

Before trusting claims that something is "best", ask a few critical
questions:

1. Has the speaker been able to point to real, documented
instances of bad things happening as a result of people
doing something different?
2. Has the speaker covered the tradeoffs that go into this
practice?
3. Does the community generally endorse the practice?

Most sources skip on #2, and the community does not generally endorse
this practice. That's not to say it's bad or dangerous, but ... most
people find it unnecessary.

The official GnuPG advice on this stuff is, "trust the defaults."
Post by Matt Vance ***@yahoo.com [PGP-Basics]
1.) As I was following along with one of articles, it had me export
my newly generated subkey so I can re-import it after removing my
masterkey. I ran gpg --list-secret-keys (and also gpg -K) to
determine the keyID associated with my new subkey. However, the
output of those commands did not provide any indication as to which
key was the encryption subkey and which was the sign only subkey.
As a general rule, you can't. Use gpg --edit-key <your certificate ID>
to get a list of all the subkeys. You'll see a list of keys at the top:
the first one will be listed as "pub", and the rest as "sub". On the
right you'll see "usage: SCEA" or somesuch like that.

S = this subkey can sign
C = this subkey can certify
E = this subkey can encrypt
A = this subkey can authenticate

Hope this helps you get the correct subkey ID.
Post by Matt Vance ***@yahoo.com [PGP-Basics]
What does adding an exclamation (!) after a keyID in GPG do?
Normally, if you try to tell GnuPG to do something on a subkey GnuPG
will instead do it on the whole certificate. For instance:

gpg --keyserver pool.sks-keyservers.net --recv-key D6B98E10
gpg --list-key 001892C2

The first will import my certificate from the keyserver network. The
second will attempt to list a subkey on my certificate, but GnuPG will
instead display the whole certificate.

"!" is how one tells GnuPG, "no, really, I meant this specific subkey."


------------------------------------

------------------------------------

______________________________________________________________
Archives: http://groups.yahoo.com/group/PGP-Basics/messages
OT List: http://groups.yahoo.com/group/PGP-Basics-OT
OT Subscribe: mailto:PGP-Basics-OT-***@yahoogroups.com
Gossamer Spider Web of Trust http://www.gswot.org
Loading...