-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 26/06/13 15:30, Hauke Laging wrote: > Am Mi 26.06.2013, 15:10:19 schrieb Daniel Pocock: > >> Essentially, can anyone confirm why it is recommended to only store >> subkeys on a smart card? > > That has little to do with smartcards. Mainkeys should always be stored and > used safely ("offline"). Smartcards are typically used in an unsafe > environment. If the mainkey is on the card then it can easily be accessed by > an attacker. The key cannot be stolen but be abused. > > Highly secure mainkeys are the last line of defense. If even they are > potentially compromised there is nothing left to trust.
My own feeling is that a smart card used in a secure location is the best place for the main/primary key, especially if combined with other security measures (e.g. offline PC, reader with PIN pad). The only other issue that arises then is longevity: is a smartcard considered more or less stable than any other type of device for long term key storage? There are other practical issues too: is a smartcard likely to survive a fire if stored in one of those fire-proof packets in a safe? A fire-proof box for a HDD or laptop tends to be much more expensive than one that just holds a small documents/smartcards/DVD media -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJRyu+rAAoJEOm1uwJp1aqDYi0QAMB4+HJIFIltLAUYne7q0Tue 1LsPgyDT4OiXW0pFFHt/bzdneufSjmQq7VNmoFuEE/bzpLOb2pVxDLO6QESdtn2L 0fFh4xdIhOmDSu8/JpK5hY+6r8PNEQPZ+havPke2vSJDMobtR5RS3T3X3p+nEh0/ RUo9x/bTooRwYFz25cYpoMOh5rJAgFRtpRlBbwLpG0H1Jh+oANLRsmRbD45PKST2 6lMTYbD9jIwOI2teJq0960aPmRgbaCYUeS8roacgmF+ANSwsYiwTnfGvx9PyhwzJ 5Zw2UE9Dyh/GkGCU4+b2uMqQsTlQmSk6IowZGp4jrAgpBApZnu4kmUXYUAfTnULX pPW/1SVvCTUId2AIw5ovNdicg1uAwsJ2XHjbDvP3saP56EG8qTY6c5bzord1Z2+8 fZyaU/B/jyjS5ZCUBn5GBhM96DAJXX9BTi5DaoWlA8QgKhL1UhjQDlVnQ2hIGvls BPx7RWhKkPzShDq+q0q3L9MUuesrvxCFqgQEfQAPSJZj3+YGTrGx3rOP5rOC/fd0 uUAusbwJt6jYGZI0f3dKZF1XzCVD6KOzlxHuAGdYmHr1LiwxBjXiAauEI+smX60V 8gqKa85uicJFjDtElbBKrzmntWV3Og0QeBxV0UVMBKwxDSCpaYjQDur2lQbJ23LA IzWG2dXw2gzTSV5MXRl/ =4UyJ -----END PGP SIGNATURE----- _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users