[Q] DSA 1024-bit limit.

[Denis McCauley]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Tue, 13 May 2003 10:45:41 -0400
Daniel Carrera <dcarrera@math.umd.edu> wrote:

> > Some people (like me), have a 4096-bit RSA signing key, but use a
> > 1024-bit DSA subkey for day to day use.
> 
> I'm interested.  How can I do that?
> I already have a "key chain" (is that what you call it?).  Do I need to 
> start over?
> 
You can have more than one key pair on your keyring. To create a key
like that of David Shaw (or mine) you create a new key choosing the
option (5) RSA (sign only). Then you add the other (sub) keys:
     >gpg --edit-key <keyID>
     >addkey
which brings up the key-creation dialogue. When the subkey has been
created finish with
     >save

You can have either DSA (sign) and ElGamal (encrypt), or stay with RSA,
which will allow you to have a bigger signing subkey (2048 bits for
example).

IMO, the real worry with the 1024-bit limit on regular DSA keys is that
they are the primary keys on which you collect the signatures that
construct your web of trust. If you have to revoke them because they are
no longer secure you lose all the signatures you've painstakingly
collected. Subkeys on the other hand can be revoked and replaced as
necessary without affecting signatures on the primary key.

However, there are some problems associated with such keys. You should
check out Adrian von Bidder's explanation at
http://fortytwo.ch/gpg/subkey
> 
> Is there a limit on now large an RSA signing key can be?

4096 bits with GPG, though there are some unofficial versions of PGP
which can create RSA keys up to 16k.


- --
=====================================
Denis McCauley
GPG/PGP keys at http://www.djmccauley.tk
=====================================

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1-nr1 (Windows 2000) - GPGshell v2.70
Comment: Key ID: 0x578247B4 (using signature subkey 0x4980C4F7)
Comment: 3C0A D97D 5FC5 A250 20BC EBC6 EB0E 9716 5782 47B4

iD8DBQE+wWgSJpZGKkmAxPcRAmu2AKCbXcLS73dAzENq8+g0w8ZFeh8gFgCg272T
LmuvzrSbAV5RCWHudt96Nps=
=hcxB
-----END PGP SIGNATURE-----

_____________________________________________________________________
Envie de discuter en "live" avec vos amis ? Télécharger MSN Messenger
http://www.ifrance.com/_reloc/m la 1ère messagerie instantanée de France