Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I created my PGP key in 2000. I’ve revoked the older, weaker sub-keys in favor of a 4096-bit RSA one, but the primary key is 1024-bit DSA. I read on Wikipedia that…

NIST 800-57 recommends lengths of 2048 for keys with security lifetimes extending beyond 2010.

  1. Should I consider my primary key insecure?
  2. If so, is there any way to replace it without revoking my entire key and creating a new one?
  3. If my primary key were compromised, the attacker would be able to create signatures as me, but they wouldn’t be able to decrypt information that was encrypted to my public key, right?
share|improve this question
2  
Not a direct answer, but I generally use keylength.com (NIST and ECRYPT recommendations) as good indicators for key strength. –  owlstead Aug 20 '13 at 19:21
    
I don't know if the PGP software you use supports this, but given that the trust system conforms to the "web of trust" model, the best way to replace your key would probably be to first generate a new key, then use your existing key to authenticate your new key to your contacts, before you revoke the old one. –  Henrick Hellström Aug 23 '13 at 6:14
add comment

1 Answer

up vote 5 down vote accepted

"Secure" is not a binary, black-and-white thing. Instead, it's about risk management. Instead of asking whether something is secure, it's better to ask whether it is "secure enough for such-and-such purpose". On the one hand, 1024-bit keys are uncomfortably close to what can be cracked, given lots of computational resources. On the other hand, for casual use, it's probably fine, and there's no need to go through a painful exercise to replace your key. But if you're generating new keys, these days it'd be a good call to use a 2048 bit key.

On your third question, someone who recovers your 1024-bit private signing key today would not be able to decrypt past ciphertexts, but they would be able to mount man-in-the-middle attacks on you in the future (which would let them decrypt information that anyone encrypts to you in the future), assuming they are willing to mount active attacks.

share|improve this answer
    
Thanks for your answer. Could you add a sentence or two addressing my second question? –  bdesham Aug 21 '13 at 20:45
    
@bdesham, sorry, I don't know the answer to your second question. I don't know of any way to replace it without revoking it and creating a whole new key, but maybe someone else will know. –  D.W. Aug 22 '13 at 0:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.