Trouble signing (was: Trouble exporting keys)

[Dennis Lambe Jr.]

--=-LnKHERv9G6dyINti0VXI
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Wed, 2003-05-14 at 20:53, Daniel Carrera wrote:
> > The --export command exports all of this to one big ugly chunk, which i=
s
> > exactly what you want.  You're exporting the RSA key, and the DSA
> > signing subkey, and the ElGamal encryption subkey.=20
>=20
> But, for instance, the people who have my older key can still authenticat=
e=20
> messages signed with my DSA key (which they have).  Correct?
> Do people just update keys every once in a while?  This would make sense.=
 =20
> And it'd also explain why the primary key can't change -- you use it to=20
> authenticate changes in the "big" key.
>=20
> This is making more sense now.

This is all exactly right so far.  As soon as you start seeing your key
as a changing collection of constant, verifiable packets, OpenPGP starts
making a lot more sense.

> But clearly, I'm still doing things wrong.  It looks like my GPG just=20
> decided to only sign with the RSA key regardless of what I tell it.  I=20
> thought I could select the key using the -u option, but that worked only=20
> once.  :(
>=20
> My DSA KeyID is 0FEBCEC3.  My RSA KeyID is E3CA8FAE :
>=20
> dcarrera ~/keys $ gpg --output file.asc -u 0x0FEBCEC3 --clearsign file
>=20
> You need a passphrase to unlock the secret key for
> user: "Daniel Carrera (PhD Student, Math) <dcarrera@math.umd.edu>"
> 2048-bit RSA key, ID E3CA8FAE, created 2003-05-13 (main key ID 0FEBCEC3)
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

OK, I'm doing a lot of educated guessing, so if I make any incorrect
assumptions, let me know.  Here's what I think is going on:

1. You have a DSA primary key, ID 0FEBCEC3.  (I know this to be true,
I've got an older version of it with only an ElGamal encryption subkey.)

2. You recently attached an RSA signing subkey to it with subkey ID
E3CA8FAE.

3. You're trying to sign things with the DSA key, but the RSA subkey
keeps getting used instead.

OK.  Now I have two issues to address.  One is why what you want to
happen isn't happening, and the other is why you might not be doing what
you mean to anyway.  Both topics contain useful information, so I'll
cover them in order.

WHY WHAT YOU WANT TO HAPPEN ISN'T HAPPENING:
The -u flag (and all other flags which take a KeyID as a parameter) is
intended to allow you to specify a full PGP key, complete with IDs,
subkeys, signatures, and all the trimmings.  You can use the primary
KeyID, a unique piece of any ID string, or any subkey ID.  The effect is
always the same: pointing out which key on the keyring should be used.=20
So -u E3CA8FAE is (for better or worse) synonymous with -u 0FEBCEC3.

GnuPG's signing behavior is: once it's found a key on the keyring, it
signs with the most recently created/modified signing subkey attached to
that key.  In your case, that's the RSA signing subkey.

Overriding this default behavior, which is what it seems you'd like to
do, is accomplished by postfixing the keyID with an exclamation point.=20
so, -u 0FEBCEC3! means "really sign with my primary key, not my most
current signing subkey".

WHY WHAT YOU'RE TRYING TO DO MIGHT NOT BE WHAT YOU WANT TO DO
If your goal in having both an RSA and a DSA signing key is to have a
long-term-secure primary key on which to collect signatures, and a
standards-compliant day-to-day document-signing DSA key, you've got them
backwards.  the RSA key should be the primary key, since it can be big,
and the DSA key should be the signing subkey, since it is trusted by the
government to sign documents.  This does require that you completely
revoke your current primary key and start from scratch, though.

I hope this helps.

--Dennis Lambe

--=-LnKHERv9G6dyINti0VXI
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: My public key is available at http://cif.rochester.edu/~malsyned/public_key.html

iD8DBQA+w0RP+yh/ThbejSgRAolMAKC4ompz3TmE9uI1Ue3VSPgpQ6KwkACgnZV0
4pbJvf/zUe0QbkVjonslsNc=
=Ene/
-----END PGP SIGNATURE-----

--=-LnKHERv9G6dyINti0VXI--