Let's say I generate a keypair for a user with go's ed25519 package:

pub, private := ed25519.GenerateKey(nil)

And I want to generate additional child keys as signing identities for my user. Is it more secure to not use that public key created at initial generation and instead derive a new child private key as a signing identity? Or is creating another child key exactly as secure as using the public key created at generation?

A general common technique is used in PGP "key rings" or "key chains". You generate a master public-key pair and distribute your master public key. Use this master private key to certify your other generated keys so that you can store your private key securely, probably off-line, and use the other keys for daily usage. With your master public key, the certificates of the other generated keys in the chain can be verified.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.