Lifecycle of a key

[Christoph Burschka]

Hello,

I'm sorry if I'm asking something well-known; I wasn't able to find any
information about this.

I know that setting an expiration date for a key is a good security precaution.
On the other hand, exchanging signatures is a lot of effort, and a PITA to have
to do again every time your key expires.

So I would hope there is some method of "transfering" the signatures you have
gathered on your old key to a new key pair. Or is this only possible indirectly
by signing the new key with the old before the old one expires?

Thanks,
-Christoph

[Neil W Rickert]

Post by Christoph Burschka
I'm sorry if I'm asking something well-known; I wasn't able to find any
information about this.
I know that setting an expiration date for a key is a good security
precaution. On the other hand, exchanging signatures is a lot of
effort, and a PITA to have to do again every time your key expires.

If I had to do it again, here is what I would do:

I would create one signing key (usable only for signing), with
my name but no email address. That is the key I would ask others
to sign. And it would not have an expiration date. This master
signing key would have a long enough key that it can probably be
good for a long time. I still might consider doing this.

Then I would create other keys for particular email addresses, and
probably with expiration dates, and perhaps shorter key lengths.
I would sign these keys with the master signing key.

Post by Christoph Burschka
So I would hope there is some method of "transfering" the signatures
you have gathered on your old key to a new key pair. Or is this only
possible indirectly by signing the new key with the old before the
old one expires?

Signing is the best you can do.

[Solbu]

Post by Christoph Burschka
I know that setting an expiration date for a key
is a good security precaution.
On the other hand, exchanging signatures is a lot of effort,
and a PITA to have to do again every time your key expires.

You can also change the expirery date later.
Then you just need to work out a way for your friends
and, or clients to update your key.
Usually by emailing them the updated public key
or uploading it to a keyserver, which is what I do when I update my key.

- --
Solbu - http://www.solbu.net
Remove 'ugyldig.' for email
PGP key ID: 0xFA687324