Re:Welp, there go my Git signatures
by hdhzy on Wednesday October 25, 2017 @04:28AM
(#15548394)
> With GPG, the only key that _has_ to be used for signing is the master key, the first key that appears in a user's key listing. For all other sub-keys, each key is explicitly marked as having a specific purpose.
Well it's only by-convention [0]:
> By convention, the top-level key provides signature services, and the subkeys provide encryption services.
Personally I left the main key with Certify only (disabled Sign when creating the key with expert mode) and generated signing keys as subkeys.
> One important thing to note, though, is that the OpenPGP Card standard (which the Yubikey implements) has an optional flag, which requires the PIN every time you do a signature. So, for me, the authentication key is like a local agent-stored SSH key: You "unlock" it once, and then it works for a while before you have to re-enter the PIN. But for signing, I have to re-enter the PIN every time.
A middle ground for encryption and authentication keys is Yubico's touch-to-use [1], you enter your PIN once and then have to touch the token to use the key.
Well it's only by-convention [0]:
> By convention, the top-level key provides signature services, and the subkeys provide encryption services.
[0]: https://tools.ietf.org/html/rfc4880#section-5.5.1.2
Personally I left the main key with Certify only (disabled Sign when creating the key with expert mode) and generated signing keys as subkeys.
> One important thing to note, though, is that the OpenPGP Card standard (which the Yubikey implements) has an optional flag, which requires the PIN every time you do a signature. So, for me, the authentication key is like a local agent-stored SSH key: You "unlock" it once, and then it works for a while before you have to re-enter the PIN. But for signing, I have to re-enter the PIN every time.
A middle ground for encryption and authentication keys is Yubico's touch-to-use [1], you enter your PIN once and then have to touch the token to use the key.
[1]: https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_...