Re: Trying to understand the bond between master and subordinal key pairs

[Daniel Kahn Gillmor]

On 02/12/2014 06:40 AM, Michael Anders wrote:

> I am still puzzled, however. Can anyone explain the logical reason as to
> why we need this jungle in OpenPGP, which thankworthily is usually more
> or less hidden from the user anyways? 
> A good reason would help the complicated workings to stick with my
> memory :-) 
> Why would we need more than one key and this hierarchy on top of it?
> (Proper padding according to the standard to my knowledge removes even
> the dangers of using the same RSA key for signatures as well as for
> ciphers.)

it's a bad idea to use the same key for multiple mechanisms.  keeping
the uses distinct is the most reliable way to avoid cross-protocol
attacks.  For a given key, it's very difficult to effectively mandate
that everything uses "proper padding" or that different uses will use
distinct padding from every other use.  Being able to associate keys
with your primary identity that might be used in other contexts (c.f.
recent discussions about bitcoin and otr) is a useful feature.

> Is the necessity (given that it is there) for the subkey hierarchy
> endemic to RSA or would such a structure also be needed for ECC or other
> cryptosystems?

here are four reasons at least that are not specific to any particular
public key cryptosystem.  there are probably more:

 * offline primary keys

 * subkeys that are incapable of being abused to make fraudulent OpenPGP
identity certifications

 * subkey-specific export: you can make a key, let an agent use it on
your behalf in one context without allowing that agent access to any of
your other keys.

 * frequent expiry/rollover of encryption or signing subkeys while the
primary key (and thus the user's identity) stays constant.  this can
deal with a heavily-used signing public key, for example, to mitigate
attacks that scale with volume of visible signatures.  for encryption
keys, this can also potentially be used as a (weak) form of forward
secrecy, assuming the user actually destroys the secret key when it expires.

Regards,

--dkg



signature.asc
Description: OpenPGP digital signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Trying to understand the bond between master and subordinal key pairs

[Michael Anders]

On Wed, 2014-02-12 at 11:38 +0100, gnupg-users-requ...@gnupg.org wrote:
> Am Mi 12.02.2014, 07:02:51 schrieb Faru Guredo:
> 
> > This is suggested???as far as I understand???in order to keep
> > the original master key for signing in a secret place, because
> master
> > signing key = my genuine identity. But.
> 
> Signing (data) is not the relevant aspect of a mainkey. Certification 
> (i.e. signing key components) is. You can create mainkeys which are
> not 
> capable (i.e: not allowed) of signing data at all.
> 
> 
> > Which public keys should be uploaded to the keyserver?
> 
> All public keys must be available to the public. (You cannot even 
> prevent that from happening.) The public mainkey is necessary for the 
> verification that the subkeys belong to this mainkey. Furthermore it
> is 
> needed for the fingerprint check.
> 
> 
> > But what about gathering
> > signatures of other people on your own public key? Should I upload
> > public key of my master signing key along with the public key of the
> > subordinate keypair I am planning to use daily?
> 
> These two components are not related at all. These should be two 
> distinct questions.
> 
> 
> > I don?t get the bond between master keys and subordinate keys. Does
> it
> > even exist?
> 
> The mainkey binds the subkeys by signing them. Signature subkeys have
> to 
> sign the mainkey, too, in order to become valid.
> 
> OpenPGP considers signatures by a subkey as equivalent to those by a 
> mainkey. But if everyone understand what this means (and how it can
> be 
> checked) then you can use the protected mainkey for more secure 
> signatures (if you do not have a more secure other key). You can use
> it 
> for more secure encryption, too (again: If everyone involved
> understands 
> how to do that).
> 
> 
> > To me they look like totally different keys.
> 
> They are, technically. They could even be exchanged. But the OpenPGP
> key 
> format marks one as the mainkey and the other ones as subkeys.
> 
> 
> > Okay, when I
> > usually sign files with key  when I send them to Alice, and
> > eventually I want to sign her key (?which of her keys, actually? The
> > one she uses daily or the one she keeps like me? If she keeps it,
> how
> > did it get to me? Which public keys supposed to collect signatures
> of
> > other people ??of the master one or newly created subordinate one?),
> > I need to use my master key . How does she know that
> 
> > is also my key if they have different IDs?
> 
> That's not the way keys are used. You tell the application to use the 
> key 0x. That always refers to a mainkey. The OpenPGP
> subsystem 
> (GnuPG) then selects the appropriate key: either the mainkey of a 
> subkey. Your contacts only verify 0x. Possible subkeys are 
> verified automatically (you cannot prevent that). Signatures are
> shown 
> to be made by the mainkey.
> 
> More precise: GnuPG does show you the subkey which made the signature 
> but I don't believe any GUI does (in a way useful to beginners). You
> can 
> even force GnuPG to use a certain subkey (if technically possible) or 
> the mainkey and thus override the automatic selection. But I have
> never 
> seen a higer-level application offering that.
> 
> 
> > (Let?s assume public key of the master pair is irrelevant,
> 
> That is not a useful assumption.

I kept wondering about this too. 
Thanks a lot for the explanation of how it works.

I am still puzzled, however. Can anyone explain the logical reason as to
why we need this jungle in OpenPGP, which thankworthily is usually more
or less hidden from the user anyways? 
A good reason would help the complicated workings to stick with my
memory :-) 
Why would we need more than one key and this hierarchy on top of it?
(Proper padding according to the standard to my knowledge removes even
the dangers of using the same RSA key for signatures as well as for
ciphers.)

Is the necessity(given that it is there) for the subkey hierarchy
endemic to RSA or would such a structure also be needed for ECC or other
cryptosystems?

Cheers,
   Michael Anders



___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users