4 ms·
I have two more questions. 1. Does it ever expire? 2. What would you do exactly if you were to lose the hardware key? Same thing as if you lost your id_ed2551
by johnisgood 2y ago
I have two more questions.
1. Does it ever expire?
2. What would you do exactly if you were to lose the hardware key? Same thing as if you lost your id_ed25519 file?
> Key rotation should be fast, painless, and regular.
I agree. Right now I keep changing the expiry date of my GPG keys (once in a good while).
- nine_k 2y ago1. A hardware key usually has no clock. But software, such as GPG, can set and check they key expiration date, and complain. For git, you usually have to have an SSH key for access, and a GPG key to sign commits, even though signing with an SSH key is possible by now. I keep signing with GPG, so that if my ssh key is rotated or revoked, my commits still remain signed. 2. If you lose a key, whatever its nature, you unenroll it where you have it enrolled. You better have some one-time codes set up, or another alternative method, like a password login to your VM via console.
- johnisgood 2y agoThank you for the answers! I use GPG to sign, too, and authenticate with SSH (but with my GPG key that has an A subkey through gpg-agent).