Re: wanted: educate us please on key dongles

From	Jonathan McDowell <noodles@earth.li>
Newsgroups	linux.debian.project
Subject	Re: wanted: educate us please on key dongles
Date	2017-08-12 00:00 +0200
Message-ID	<udq8i-la-7@gated-at.bofh.it> (permalink)
References	<ua8hC-6jk-65@gated-at.bofh.it> <udi14-3YT-19@gated-at.bofh.it> <udlBE-6fZ-37@gated-at.bofh.it> <udlUZ-6mk-3@gated-at.bofh.it> <udoga-7EJ-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, Aug 11, 2017 at 04:52:36PM -0300, Henrique de Moraes Holschuh
wrote:
> On Fri, 11 Aug 2017, Jonathan McDowell wrote:
> > I see no reason why the master key should ever be used for
> > signatures in such a scenario, so it seems sensible to indicate that
> > it is purely for certification.
> 
> Well, it can be useful.  A SC master key (Sign and Certify) can be
> used to sign messages explaining to someone else the need for a new
> subkey when you had to revoke every subkey, when just adding the
> subkey itself is not enough, or when adding subkeys is subject to a
> delay.
> 
> Suppose you forget to renew/upload a new subkey in your Debian key
> set, and the current subkeys expire: it takes time for a new subkey
> upload to clear keyring maint.  During that time, an SC master key can
> be used in an emergency to sign a vote or an upload.

I see this as a failure to manage the signing subkey correctly, and a
certification only master key as helping to prevent the temptation to
just make use of the master for signing (and potentially avoid jumping
through all of the hoops required to use it securely).

(That said, I'm very conscious that a lot of crypto comes down to a set
of tradeoffs and I'm all in favour of people who have strong informed
opinions about how to do things differently doing those things if they
want. But if you ask me for a base line set of advice to J. Random DD
I'd still go with the certification only master.)

J.

-- 
... And you can't help my life. But you can hide the knives.

Thread

wanted: educate us please on key dongles Adam Borowski <kilobyte@angband.pl> - 2017-08-02 22:20 +0200
  Re: wanted: educate us please on key dongles Zlatan Todoric <zlatan@riseup.net> - 2017-08-02 22:40 +0200
  Re: wanted: educate us please on key dongles Jonas Smedegaard <dr@jones.dk> - 2017-08-02 22:50 +0200
  Re: wanted: educate us please on key dongles Wouter Verhelst <w@uter.be> - 2017-08-03 11:30 +0200
  Re: wanted: educate us please on key dongles Wouter Verhelst <wouter@debian.org> - 2017-08-03 11:30 +0200
  Re: wanted: educate us please on key dongles Daniel Pocock <daniel@pocock.pro> - 2017-08-03 13:40 +0200
  Re: wanted: educate us please on key dongles Víctor Cuadrado Juan <me@viccuad.me> - 2017-08-03 19:10 +0200
  Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-11 15:20 +0200
    Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-11 17:30 +0200
      Re: wanted: educate us please on key dongles Sean Whitton <spwhitton@spwhitton.name> - 2017-08-11 19:30 +0200
        Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-11 19:50 +0200
    Re: wanted: educate us please on key dongles Sean Whitton <spwhitton@spwhitton.name> - 2017-08-11 19:10 +0200
      Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-11 19:30 +0200
        Re: wanted: educate us please on key dongles Henrique de Moraes Holschuh <hmh@debian.org> - 2017-08-11 22:00 +0200
          Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-12 00:00 +0200
    Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-29 19:40 +0200
      Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-29 20:00 +0200
      Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-30 11:10 +0200
        Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 12:20 +0200
          Re: wanted: educate us please on key dongles Adam Borowski <kilobyte@angband.pl> - 2017-08-30 12:50 +0200
            Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 13:00 +0200
              Re: wanted: educate us please on key dongles Ian Jackson <ijackson@chiark.greenend.org.uk> - 2017-08-30 13:20 +0200
                Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 15:00 +0200
              Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 13:20 +0200
              Re: wanted: educate us please on key dongles Jonathan McDowell <noodles@earth.li> - 2017-08-30 13:20 +0200
              Re: wanted: educate us please on key dongles Ian Campbell <ijc@debian.org> - 2017-08-30 17:20 +0200
        Re: wanted: educate us please on key dongles Alexander Zangerl <az+debmnt@snafu.priv.at> - 2017-08-31 00:40 +0200
    Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-29 20:10 +0200
      Re: wanted: educate us please on key dongles Henrique de Moraes Holschuh <hmh@debian.org> - 2017-08-29 21:10 +0200
        Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 09:10 +0200
          Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-30 14:00 +0200
            Re: wanted: educate us please on key dongles Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-30 14:50 +0200
              Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-08-30 17:20 +0200
            Re: wanted: educate us please on key dongles Christian Seiler <christian@iwakd.de> - 2017-09-22 22:10 +0200
          Re: wanted: educate us please on key dongles Teemu Likonen <tlikonen@iki.fi> - 2017-08-30 14:10 +0200
          Re: wanted: educate us please on key dongles Sean Whitton <spwhitton@spwhitton.name> - 2017-08-31 07:10 +0200
  Re: wanted: ... key dongles GNUK is available Osamu Aoki <osamu@debian.org> - 2017-08-16 17:00 +0200
    Re: wanted: ... key dongles GNUK is available Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-29 19:50 +0200
  [summary] Re: wanted: educate us please on key dongles Charles Plessy <plessy@debian.org> - 2017-09-08 15:20 +0200
    Re: [summary] Re: wanted: educate us please on key dongles Sotirios Vrachas <sotirios@vrachas.com> - 2017-09-09 22:20 +0200
      Re: [summary] Re: wanted: educate us please on key dongles Charles Plessy <plessy@debian.org> - 2017-09-10 06:00 +0200

csiph-web