Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yes -- revocation is just an indicator of the subkey's trust going forward. Once revoked, the user would generate a new subkey and re-encrypt their password wallet. While the git features and multi-key capabilities of pass lend well to very lightweight team usage, the model is definitely best suited for use by an individual.


So a subkey is aware of all revocations from before it was generated?

If I generate 2 subkeys, can they both encrypt and decrypt my passwords? The only difference is that I can revoke them independently?


Sorry, to clarify, you need to keep a backup of all subkeys along side your master/certifying key. Data encrypted to a given subkey can only be decrypted by that same subkey.

Honestly, if you're using GPG strictly for personal password wallet encryption, and don't intend to maintain an identity tied with the key long term, there's no need to do the subkey thing -- just create an offline key, load it to your YK, then securely store the offline key.

Subkeys shines when you want to maintain an identity long term, while allowing rotation of the keys that do your day to day encryption (or signing/auth)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: