<html><head></head><body><br>
It is important to re think all usecases and create rfc or so to update standards.<br>
<br>
Please see PIV standards they hold about 32 slots or more if I remember correct.<br>
<br>
The hard ware tokens should support more slots to hold expired subkeys and also if possible some signed public keys or whatever as a means for offline WOT.<br>
<br>
I Know GnuPG will no settle for unsafe practices like not rotating subkeys because of old standards.<br>
<br>
Its time to make GnuPG Great again. Make it more usable while not compromising on security.<br>
<br>
You guys rock 🎸<br>
<br>
<br>
<br><br><div class="gmail_quote">On September 23, 2017 7:02:36 AM CDT, gnuk-users-request@lists.alioth.debian.org wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Send gnuk-users mailing list submissions to<br /> gnuk-users@lists.alioth.debian.org<br /><br />To subscribe or unsubscribe via the World Wide Web, visit<br /> <a href="https://lists.alioth.debian.org/mailman/listinfo/gnuk-users">https://lists.alioth.debian.org/mailman/listinfo/gnuk-users</a><br />or, via email, send a message with subject or body 'help' to<br /> gnuk-users-request@lists.alioth.debian.org<br /><br />You can reach the person managing the list at<br /> gnuk-users-owner@lists.alioth.debian.org<br /><br />When replying, please edit your Subject line so it is more specific<br />than "Re: Contents of gnuk-users digest..."<br /><br /><br />Today's Topics:<br /><br /> 1. Multiple retired encryption keys (Gary)<br /> 2. Re: Multiple retired encryption keys (Duncan)<br /><br /><br /><hr /><br /><br />Message: 1<br />Date: Fri, 22 Sep 2017 23:21:46 +0100<br />From: Gary <gary@mups.co.uk><br />To: gnuk-users@lists.alioth.debian.org<br />Subject: [Gnuk-users] Multiple retired encryption keys<br />Message-ID: <93f105f8-fe38-fe3a-415b-7650475d5a74@mups.co.uk><br />Content-Type: text/plain; charset=utf-8<br /><br />Hi all,<br /><br />I've been wondering what to do when my current sub-keys expire. Modify<br />the expiry date to keep them active for another few years, or generate a<br />new encryption sub-key.<br /><br />The latter option would be preferable but then it raises the question of<br />what to do about the old encryption key(s) given that the gnuk only<br />supports 3 slots for E,S,A and I'd want to retain access to old<br />encrypted data.<br /><br />Is there any way to add extra keys beyond the 3 slots for E,S,A the gnuk<br />provides?<br /><br />If not, what level of work would be involved to get gnupg+gnuk to<br />support the addition of multiple expired/old encryption keys? Is this<br />something that's likely to happen?<br /><br /><br />Regards,<br /><br />Gary<br /><br /><br /><br /><hr /><br /><br />Message: 2<br />Date: Sat, 23 Sep 2017 02:51:00 +0000<br />From: Duncan <dguthrie@posteo.net><br />To: gnuk-users@lists.alioth.debian.org<br />Subject: Re: [Gnuk-users] Multiple retired encryption keys<br />Message-ID: <3a32a650-76a3-9f1d-19d6-8bf11cac0751@posteo.net><br />Content-Type: text/plain; charset=utf-8<br /><br />Hi Gary,<br /><br />Gary:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Hi all,<br /> <br /> I've been wondering what to do when my current sub-keys expire. Modify<br /> the expiry date to keep them active for another few years, or generate a<br /> new encryption sub-key.<br /> <br /> The latter option would be preferable but then it raises the question of<br /> what to do about the old encryption key(s) given that the gnuk only<br /> supports 3 slots for E,S,A and I'd want to retain access to old<br /> encrypted data.<br /> <br /> Is there any way to add extra keys beyond the 3 slots for E,S,A the gnuk<br /> provides?<br /> <br /> If not, what level of work would be involved to get gnupg+gnuk to<br /> support the addition of multiple expired/old encryption keys? Is this<br /> something that's likely to happen?<br /> <br /> <br /> Regards,<br /> <br /> Gary<br /> <br /></blockquote><br />This appears to be less of a question of "what can Gnuk do", and more of<br />backing up the private key material before exporting it to the<br />smartcard/token.<br /><br />For future reference, if you have an offline computer where your master<br />key material is stored, where you generate subkeys and then export them<br />to smartcards/tokens, you can choose not to save that they have been<br />exported from the master key after running the keytocard option. This<br />means you can still have access to private key material of the subkeys<br />after exporting the key to the card/token.<br /><br />Unfortunately, the OpenPGP card standard does not allow more keys to be<br />added. I do not think it makes much sense to extend the standard, due to<br />the design of smartcards. In any case, when we update Gnuk, you would<br />lose access to the private key on the token anyway. However, Gnuk token<br />is not completely standards-compliant, so maybe it would be possible, at<br />a push.<br /><br />I think your best option, since it is not possible (without invasive<br />methods, and even then quite difficult) to extract private key material<br />from the Gnuk token, is to keep the old tokens if you wish to keep<br />access to these, and use new tokens for your new keys (while following<br />the practice above).<br /><br />If your subkeys have not been compromised (I think in most cases this<br />would mean that the token did not get stolen - something that's implicit<br />from what you've said), and there is no reason to regenerate keys for<br />security reasons, then I don't see what's wrong with extending the<br />expiry date of your old keys and then creating keys marked 'new', e.g.<br />write "new long-term signing key" in the comment for the new signing<br />subkey, and "old long-term signing key" in the comment for the old key.<br /><br />Best,<br />Duncan<br /><br /><br /><br /><hr /><br /><br />Subject: Digest Footer<br /><br /><hr /><br />gnuk-users mailing list<br />gnuk-users@lists.alioth.debian.org<br /><a href="https://lists.alioth.debian.org/mailman/listinfo/gnuk-users">https://lists.alioth.debian.org/mailman/listinfo/gnuk-users</a><br /><br /><br /><hr /><br /><br />End of gnuk-users Digest, Vol 95, Issue 1<br />*****************************************<br /></pre></blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>