Hello, I'm new to GPG, and after having read the documentation, I still have a few questions:
Suppose Alice generates a new master signing key, and along with it the UID "Alice <u...@alice.com>". Then, she issues adduid to add "Alice <u...@company.com>", her company mailing address. After some time, she leaves the company, invalidating her email address. Consequently, she revokes her UID u...@company.com and sends her updated public key to everyone she's in contact with. Then, for some reason, Alice joins aforementioned company again, re-gaining control of her mail address u...@company.com. Can she add a new UID of the same name "Alice <u...@company.com>" to her gpg key again? I understand that she would not be able to re-use signatures she collected on her "old" UID on her "new" one, but would have to start building trust from scratch. But still, is it possible to do so, or would the revocation of the "old" uid2 also immediately apply to the "new" uid2? In another scenario, Alice not only has a master key, but also subordinate keys, say for her notebook and mobile phone. First, can she say that the mobile phone should be able to sign/decrypt only for u...@alice.com? How so? Second, if her notebook subordinate key can sign/decrypt for both UIDs, and someone sends a mail to u...@alice.com, which pubic key does he encrypt the message with? I assume the sender, by default, would simulatenously use all encryption keys (master or subordinate) he knows of, so that the message can be decrypted with any one private key. Is that the case? Can the sender choose to only encrypt using one of the keys, e.g. to make sure Alice doesn't read the message on her phone, but waits until she gets home to her notebook (in case the sender considers it more trustworthy, and the sender knows how the keys are associated with Alice's machines)? What happens if a subordinate key of mine expires? Can I just generate a new one and let people know? Or would I also have lost trust/signatures of my identities gathered in the past? Phrased differently, if Bob signes Alice's UID X, what does he sign exactly? Just that he trusts UID X belongs to the name and address given in UID X, and that UID X is associated with Alice's master key, or does Bob's signature also say something about subordinate keys of Alice's gpg key and/or other UIDs of Alice which Bob did not intend to verify? Finally, I am wondering how I should organise my UIDs. I could either have one gpg key and add each UID to that one, or I could have multiple seperate gpg keys, one for each UID. The latter approach seems more flexible to me, in terms of choosing how much information I want to disclose to recipients of my gpg keys, and, depending on the answers to the questions above, also in terms of control I have over how my keys are used. Does having all UIDs in one gpg key have any advantages, except for being easier to organise for me and for people who want to sign my identities? Would it be considered strange, or even rude of some sort, if I asked someone to sign a number of identities of mine scattered across multiple gpg keys, instead of just handing them one gpg key and asking them to sign UIDs x, y and z? I know these are a lot of questions, but I honestly couldn't find satisfactory answers in the documentation or using search engines. I would be very grateful if you could attempt to enlighten me. :) Thank you very much in advance! P.S.: It seems like my previous attempt to post this message failed. I hope the mail won't come through twice now. I'm sorry if it does. _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
