9
$\begingroup$

Is it possible for myself to change the key size (say from 2048 to 4096) on an EXISTING PGP / GPG key, and just republishing that key?

Or do I have to generate a new key all together?

I want to say that you have to create a new key pair, but I don't have enough documentation either way to support a claim.

Improve this question
$\endgroup$
3
  • 4
    $\begingroup$ Have a look at this answer I gave on SuperUser for a similar question. $\endgroup$
    – Jens Erat
    Commented Jul 7, 2013 at 19:12
  • $\begingroup$ That's what I figured, thank you for the write up. I copied it as-is and cited the answer and yourself down below. Please feel free to answer this question exactly the same and I'll mark your answer right (I can't mark mine for a few days) $\endgroup$
    – Urda
    Commented Jul 8, 2013 at 6:36
  • 1
    $\begingroup$ If main parts of your answer aren't written by yourself, you should mark them as "Wiki Answer". $\endgroup$
    – Jens Erat
    Commented Jul 8, 2013 at 8:33

2 Answers 2

Reset to default
8
$\begingroup$

Thanks for the info Jens Erat

There is no way to "upgrade" an OpenPGP key. You will have to create a new one, and you will loose your reputation in the web of trust.

Think about:

  • Giving your new key with the old one, so other could follow the signatures
  • Revoking the old one after some time
  • Using a seemingly unnecessary large key as primary key and smaller subkeys for day-to-day usage. You will never need the primary key for anything but signing other keys (which is rare) and others verifying your signatures (cheap anyway).

Source

Improve this answer
$\endgroup$
0
$\begingroup$

Your trust is fine if you keep your 2048 Secret.asc as you can always confirm you are the true owner of BOTH keys but i know id love the impossible app where you just browse to your 2048 .asc and it churns out a nice,new shiny 4096 equivalent and nobody is none the wiser. If its to do with 'vending'...ahem, then id change the key to a new one and every person requesting proof can just send a 2048 encrypted message to the key they know and trust and request the vendor to reply with a group of numbers that the sender instructed the vendor to do on the trusted key. That way the vendor loses zero Opsec as he wont have to continue showing his 2048 key on top off his new secure key as anyone whos ever dealt with you in the past will know the 2048 key anyway and all new buyers will rely on feedback and just use the new key anyway... Drawn out explanation of the obvious really

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.