4 ms·

> Also the longer you use OpenPGP, the less keys need to be verified. The start is very hard, since you start with no trusted keys at all. The longer you use it

> Also the longer you use OpenPGP, the less keys need to be verified. The start is very hard, since you start with no trusted keys at all. The longer you use it, the more fluent usage becomes. This is exactly what scares me and the point of my "I'm giving up on PGP" article. People holding on to keys forever, moving them from laptop to laptop, never rotating them and asymptotically approaching compromise... because it's the only way to ease the pain.

peatmoss 10y ago
How do you feel about Yubikey-based keys? Asking for a friend...
- subway 10y ago
  Most workflows utilizing OpenPGP cards (like the Yubikey) encourage better key hygiene. Generally you'd create a certification key which lives offline 100% of the time, with a subkey issued to the Yubikey. This means your offline key can persist for a very long time while you can safely rotate the day to day subkey. Unfortunately while these workflows are encouraged, the tooling doesn't exist to make it a trivial operation for folks not familiar with proper key hygiene.
- matheusmoreira 10y ago
  I have a YubiKey myself and they're really convenient. There's a cryptoprocessor inside so the key doesn't have to leave the device. I think it's more secure than a regular computer connected to the internet. After reading¹² about this subject, I believe a reasonable level of security and ease-of-use can be achieved through the following process: 1. Boot a live Linux distribution such as Tails on a computer disconnected from the Internet. 2. Create the OpenPGP master key. 3. Initialize the YubiKey with subkeys. 4. Store the master key offline using paperkey³ and a machine-readable code. The YubiKey is secure and convenient enough for daily use; the subkeys can be easily revoked and the hardware reinitialized with new keys. Master key operations such as key signing and changing expiration dates require loading the master key into the offline live operating system. Much more of a hassle but hopefully not as frequent as YubiKey use. Printing the master key on quality paper ensures³ it will survive for a long time. ¹ http://security.stackexchange.com/a/51776/9252 http://security.stackexchange.com/a/51776/9252 ² http://security.stackexchange.com/a/31598/9252 http://security.stackexchange.com/a/31598/9252 ³ http://www.jabberwocky.com/software/paperkey/ http://www.jabberwocky.com/software/paperkey/
sleepless 10y ago
What would you consider a sane key rotation cycle? 1 Month? 1 year, 2 years, 4 years?

peatmoss 10y ago

How do you feel about Yubikey-based keys? Asking for a friend...

subway 10y ago
Most workflows utilizing OpenPGP cards (like the Yubikey) encourage better key hygiene. Generally you'd create a certification key which lives offline 100% of the time, with a subkey issued to the Yubikey. This means your offline key can persist for a very long time while you can safely rotate the day to day subkey. Unfortunately while these workflows are encouraged, the tooling doesn't exist to make it a trivial operation for folks not familiar with proper key hygiene.
matheusmoreira 10y ago
I have a YubiKey myself and they're really convenient. There's a cryptoprocessor inside so the key doesn't have to leave the device. I think it's more secure than a regular computer connected to the internet. After reading¹² about this subject, I believe a reasonable level of security and ease-of-use can be achieved through the following process: 1. Boot a live Linux distribution such as Tails on a computer disconnected from the Internet. 2. Create the OpenPGP master key. 3. Initialize the YubiKey with subkeys. 4. Store the master key offline using paperkey³ and a machine-readable code. The YubiKey is secure and convenient enough for daily use; the subkeys can be easily revoked and the hardware reinitialized with new keys. Master key operations such as key signing and changing expiration dates require loading the master key into the offline live operating system. Much more of a hassle but hopefully not as frequent as YubiKey use. Printing the master key on quality paper ensures³ it will survive for a long time. ¹ http://security.stackexchange.com/a/51776/9252 http://security.stackexchange.com/a/51776/9252 ² http://security.stackexchange.com/a/31598/9252 http://security.stackexchange.com/a/31598/9252 ³ http://www.jabberwocky.com/software/paperkey/ http://www.jabberwocky.com/software/paperkey/

sleepless 10y ago

What would you consider a sane key rotation cycle? 1 Month? 1 year, 2 years, 4 years?