On May 16, 2009, at 9:14 PM, Lucio Capuani wrote:
Can anyone explain why there is a difference between signing and
encrypting keypairs, even for the same type (RSA)?
As far as I've understood from the documentation, one of the reason
should be that it would be good practice to keep the signing key valid
indefinitely (thus, having one that never expires so old signatures
can be verified too) and renew the cryptographic one pretty often for
security reason. As before, I'd love to get confirmations or denials
of that ;), and if there's else about it.
That's one of the reasons. There were actually a good few reasons for
the switch at the time (the "PGP 3" timeframe, which became the PGP
5.0 product). One reason was legal, and not technical. RSA was still
patented at the time, so that couldn't as easily be used. DSA was
chosen, but DSA can't encrypt, which pretty much required a multiple
key (primary key + subkeys) solution. In addition, though, the
multiple key solution was chosen for its flexibility, as you noted.
It is handy to be able to make multiple subkeys and regenerate them as
needed.
One thing the multiple subkey design makes possible is to keep the
primary key offline altogether, and just use subkeys for all the day
to day encryption and signing needs. In this way of working, the
primary key is only used for two purposes: to make new subkeys when
that becomes necessary, and to sign other people's keys. When it is
not in use (i.e. most of the time), the primary key is stored on
separate media (say, a CD-ROM or USB stick). See the --export-secret-
subkeys description in the GPG manual for more on this.
Note, though, that if you want a single key for everything, you can
still do that. Generate yourself an RSA key using the --expert flag,
and you can create a key that is capable of both encrypting and
signing in a single key. It's unusual, and I don't recommend it, but
GPG will happily use it.
David
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
