Re: rotating encryption sub keys

2009-08-27 Thread Faramir
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 David Shaw escribió: ... > Incidentally, there have been proposals to add forward security > extensions to OpenPGP. See http://www.apache-ssl.org/openpgp-pfs.txt As a side note, I am not sure I like these proposals... "Therefore when a public

Re: rotating encryption sub keys

2009-08-27 Thread David Shaw
On Aug 27, 2009, at 6:03 PM, Joseph Oreste Bruni wrote: Would it be considered a best practice to rotate encryption subkeys on an annual basis, or would that be considered overkill for most uses? It depends on what you're trying to do. :) I realize that messages are encrypted using ephemer

Re: rotating encryption sub keys

2009-08-27 Thread Robert J. Hansen
On 08/27/2009 06:03 PM, Joseph Oreste Bruni wrote: > Would it be considered a best practice to rotate encryption subkeys on > an annual basis, or would that be considered overkill for most uses? There almost certainly exist people for whom this is a good idea. That said, I've never met 'em. It s

rotating encryption sub keys

2009-08-27 Thread Joseph Oreste Bruni
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Would it be considered a best practice to rotate encryption subkeys on an annual basis, or would that be considered overkill for most uses? I realize that messages are encrypted using ephemeral session keys which in turn are encrypted with pub

Re: changing key expiration

2009-08-27 Thread Jason Harris
On Thu, Aug 27, 2009 at 07:36:02PM +0200, Bernhard Kuemel wrote: > I changed my expiration with --edit-key expire from never to 3y and > uploaded the key. Then I changed it to 5y and uploaded the key. Now the > uploaded key has several self signatures and expiration dates on > http://pgp.mit.edu:1

Re: changing key expiration

2009-08-27 Thread Daniel Kahn Gillmor
On 08/27/2009 03:30 PM, Bernhard Kuemel wrote: > Ok, great. Could I also sign my key after it expired with a new > expiration period to revive it? Yes, i'm pretty sure you can do this, but i always take pains to try to update the expiration date *before* it passes ;) --dkg signature.as

Re: Using gpg-groups in gnome?

2009-08-27 Thread Ingo Klöcker
On Thursday 27 August 2009, debianfeed wrote: > Hello > > does anybody here know a possibility to use gpg key-groups under > gnome? groups defined in the gpg.conf > (e.g. "group mygroupname = 0x9DB0 0x9540") > do not show up in nautilus' seahorse extension. > > kgpg is capable of dealing wi

Re: changing key expiration

2009-08-27 Thread Daniel Kahn Gillmor
Hi Berhnard-- On 08/27/2009 01:36 PM, Bernhard Kuemel wrote: > It appears the key expiration is part of the signatures. Will the most > recent signature have the effective expiration date? yes, the most recent certification made by the same issuer on a given subject is considered to supercede all

Re: changing key expiration

2009-08-27 Thread Bernhard Kuemel
Daniel Kahn Gillmor wrote: > Hi Berhnard-- > > On 08/27/2009 01:36 PM, Bernhard Kuemel wrote: >> It appears the key expiration is part of the signatures. Will the most >> recent signature have the effective expiration date? > > yes, the most recent certification made by the same issuer on a given

changing key expiration

2009-08-27 Thread Bernhard Kuemel
Hi gnupg-users! I changed my expiration with --edit-key expire from never to 3y and uploaded the key. Then I changed it to 5y and uploaded the key. Now the uploaded key has several self signatures and expiration dates on http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0xF732FBF3E4219D48 Type

Re: Help with decrypting gpg file

2009-08-27 Thread David Shaw
On Aug 27, 2009, at 10:36 AM, John Betz wrote: I appreciate the offer David, but I don't have PowerArchiver so I can't create a sample input file. The file I am trying to decrypt is coming from another source so I would have to get them involved in order to create a sample archive file. Bec

Using gpg-groups in gnome?

2009-08-27 Thread debianfeed
Hello does anybody here know a possibility to use gpg key-groups under gnome? groups defined in the gpg.conf (e.g. "group mygroupname = 0x9DB0 0x9540") do not show up in nautilus' seahorse extension. kgpg is capable of dealing with groups, but as it is a KDE-application it ist not usable