<html><head></head><body><br>
<a href="https://developers.yubico.com/PIV/Introduction/Certificate_slots.html">https://developers.yubico.com/PIV/Introduction/Certificate_slots.html</a><br>
<br>
<br><br><div class="gmail_quote">On September 24, 2017 7:02:32 AM CDT, gnuk-users-request@lists.alioth.debian.org wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Send gnuk-users mailing list submissions to<br /> gnuk-users@lists.alioth.debian.org<br /><br />To subscribe or unsubscribe via the World Wide Web, visit<br /> <a href="https://lists.alioth.debian.org/mailman/listinfo/gnuk-users">https://lists.alioth.debian.org/mailman/listinfo/gnuk-users</a><br />or, via email, send a message with subject or body 'help' to<br /> gnuk-users-request@lists.alioth.debian.org<br /><br />You can reach the person managing the list at<br /> gnuk-users-owner@lists.alioth.debian.org<br /><br />When replying, please edit your Subject line so it is more specific<br />than "Re: Contents of gnuk-users digest..."<br /><br /><br />Today's Topics:<br /><br /> 1. Multiple retired encryption keys (Srinivas)<br /> 2. Re: Multiple retired encryption keys (Gary)<br /> 3. Re: Multiple retired encryption keys (NdK)<br /><br /><br /><hr /><br /><br />Message: 1<br />Date: Sat, 23 Sep 2017 07:29:59 -0500<br />From: Srinivas <vsrinu26f@gmail.com><br />To: gnuk-users@lists.alioth.debian.org,<br /> gnuk-users-request@lists.alioth.debian.org<br />Subject: [Gnuk-users] Multiple retired encryption keys<br />Message-ID: <18F20679-70FA-4B01-B249-BFA8D43D7150@gmail.com><br />Content-Type: text/plain; charset="utf-8"<br /><br /><br />It is important to re think all usecases and create rfc or so to update standards.<br /><br />Please see PIV standards they hold about 32 slots or more if I remember correct.<br /><br />The hard ware tokens should support more slots to hold expired subkeys and also if possible some signed public keys or whatever as a means for offline WOT.<br /><br />I Know GnuPG will no settle for unsafe practices like not rotating subkeys because of old standards.<br /><br />Its time to make GnuPG Great again. Make it more usable while not compromising on security.<br /><br />You guys rock ?<br /><br /><br /><br /><br />On September 23, 2017 7:02:36 AM CDT, gnuk-users-request@lists.alioth.debian.org wrote:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">Send gnuk-users mailing list submissions to<br /> gnuk-users@lists.alioth.debian.org<br /><br />To subscribe or unsubscribe via the World Wide Web, visit<br /> <a href="https://lists.alioth.debian.org/mailman/listinfo/gnuk-users">https://lists.alioth.debian.org/mailman/listinfo/gnuk-users</a><br />or, via email, send a message with subject or body 'help' to<br /> gnuk-users-request@lists.alioth.debian.org<br /><br />You can reach the person managing the list at<br /> gnuk-users-owner@lists.alioth.debian.org<br /><br />When replying, please edit your Subject line so it is more specific<br />than "Re: Contents of gnuk-users digest..."<br /><br /><br />Today's Topics:<br /><br /> 1. Multiple retired encryption keys (Gary)<br /> 2. Re: Multiple retired encryption keys (Duncan)<br /><br /><br /><hr /><br /><br />Message: 1<br />Date: Fri, 22 Sep 2017 23:21:46 +0100<br />From: Gary <gary@mups.co.uk><br />To: gnuk-users@lists.alioth.debian.org<br />Subject: [Gnuk-users] Multiple retired encryption keys<br />Message-ID: <93f105f8-fe38-fe3a-415b-7650475d5a74@mups.co.uk><br />Content-Type: text/plain; charset=utf-8<br /><br />Hi all,<br /><br />I've been wondering what to do when my current sub-keys expire. Modify<br />the expiry date to keep them active for another few years, or generate<br />a<br />new encryption sub-key.<br /><br />The latter option would be preferable but then it raises the question<br />of<br />what to do about the old encryption key(s) given that the gnuk only<br />supports 3 slots for E,S,A and I'd want to retain access to old<br />encrypted data.<br /><br />Is there any way to add extra keys beyond the 3 slots for E,S,A the<br />gnuk<br />provides?<br /><br />If not, what level of work would be involved to get gnupg+gnuk to<br />support the addition of multiple expired/old encryption keys? Is this<br />something that's likely to happen?<br /><br /><br />Regards,<br /><br />Gary<br /><br /><br /><br /><hr /><br /><br />Message: 2<br />Date: Sat, 23 Sep 2017 02:51:00 +0000<br />From: Duncan <dguthrie@posteo.net><br />To: gnuk-users@lists.alioth.debian.org<br />Subject: Re: [Gnuk-users] Multiple retired encryption keys<br />Message-ID: <3a32a650-76a3-9f1d-19d6-8bf11cac0751@posteo.net><br />Content-Type: text/plain; charset=utf-8<br /><br />Hi Gary,<br /><br />Gary:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;"> Hi all,<br /> <br /> I've been wondering what to do when my current sub-keys expire.<br /></blockquote>Modify<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;"> the expiry date to keep them active for another few years, or<br /></blockquote>generate a<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;"> new encryption sub-key.<br /> <br /> The latter option would be preferable but then it raises the question<br /></blockquote>of<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;"> what to do about the old encryption key(s) given that the gnuk only<br /> supports 3 slots for E,S,A and I'd want to retain access to old<br /> encrypted data.<br /> <br /> Is there any way to add extra keys beyond the 3 slots for E,S,A the<br /></blockquote>gnuk<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;"> provides?<br /> <br /> If not, what level of work would be involved to get gnupg+gnuk to<br /> support the addition of multiple expired/old encryption keys? Is this<br /> something that's likely to happen?<br /> <br /> <br /> Regards,<br /> <br /> Gary<br /> <br /></blockquote><br />This appears to be less of a question of "what can Gnuk do", and more<br />of<br />backing up the private key material before exporting it to the<br />smartcard/token.<br /><br />For future reference, if you have an offline computer where your master<br />key material is stored, where you generate subkeys and then export them<br />to smartcards/tokens, you can choose not to save that they have been<br />exported from the master key after running the keytocard option. This<br />means you can still have access to private key material of the subkeys<br />after exporting the key to the card/token.<br /><br />Unfortunately, the OpenPGP card standard does not allow more keys to be<br />added. I do not think it makes much sense to extend the standard, due<br />to<br />the design of smartcards. In any case, when we update Gnuk, you would<br />lose access to the private key on the token anyway. However, Gnuk token<br />is not completely standards-compliant, so maybe it would be possible,<br />at<br />a push.<br /><br />I think your best option, since it is not possible (without invasive<br />methods, and even then quite difficult) to extract private key material<br />from the Gnuk token, is to keep the old tokens if you wish to keep<br />access to these, and use new tokens for your new keys (while following<br />the practice above).<br /><br />If your subkeys have not been compromised (I think in most cases this<br />would mean that the token did not get stolen - something that's<br />implicit<br />from what you've said), and there is no reason to regenerate keys for<br />security reasons, then I don't see what's wrong with extending the<br />expiry date of your old keys and then creating keys marked 'new', e.g.<br />write "new long-term signing key" in the comment for the new signing<br />subkey, and "old long-term signing key" in the comment for the old key.<br /><br />Best,<br />Duncan<br /><br /><br /><br /><hr /><br /><br />Subject: Digest Footer<br /><br /><hr /><br />gnuk-users mailing list<br />gnuk-users@lists.alioth.debian.org<br /><a href="https://lists.alioth.debian.org/mailman/listinfo/gnuk-users">https://lists.alioth.debian.org/mailman/listinfo/gnuk-users</a><br /><br /><br /><hr /><br /><br />End of gnuk-users Digest, Vol 95, Issue 1<br />*****************************************<br /></blockquote></pre></blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>