3
$\begingroup$

So, I've generated my GPG key pair. Created a subkey for signing and a subkey for encryption. Exported the whole thing, removed my master key pair to a secure place, re-imported only the subkeys. Now, I take my fingerprint and passport to a signing party and folks verify my identity and go pull my key off a keyserver, sign it, and upload it back to the key server.

After refreshing my keys I now have their signature on my private subkey?

Does that mean upon receiving a signature from someone else I need to go get my master key pair and sign it with my private subkey or?

If I lose my laptop before transferring signatures to my main keypair they are lost forever?

$\endgroup$
7
  • 1
    $\begingroup$ The exported subkey carries information about the PGP master key, which is part of the signatures. The signatures are simply data, you can make backups of them too. $\endgroup$ – Natanael Aug 10 '19 at 10:07
  • $\begingroup$ Do I need to transfer those signatures back to my master keypair then or? $\endgroup$ – RhythmInk Aug 10 '19 at 19:07
  • $\begingroup$ you would probably need to use an import option in the PGP software to copy them over. Right now they will only be seen when you show the exported subkey. If you want them to be seen with the root key, you need to import to it. $\endgroup$ – Natanael Aug 10 '19 at 21:54
  • 1
    $\begingroup$ @Natanael Could you possibly create an answer out of your comments? $\endgroup$ – Maarten Bodewes Aug 13 '19 at 15:49
  • 1
    $\begingroup$ @MaartenBodewes perhaps later, would want to go through the spec so I can link and point to the right section $\endgroup$ – Natanael Aug 14 '19 at 15:45
1
$\begingroup$

See this explanation. The 0x10 signature (typically belonging to a different individual) is applied to one's master/primary key, not to 0x18 subkey signature packets used for signing, encrypting, and authenticating.

Remember, CA responsibilities are decentralized with the PGP Web of Trust and the one's master/primary key can be used to sign other people's master/primary keys that also act as a reputation. By signing other people's master key(s), those people can revoke and re-issue subkeys as needed (with their reputation) without the involvement of those that have applied 0x10 signatures.

With more recent gpg code, the signing subkey will have a 0x19 backsignature when created.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.