Why is there a subkey and a selfsig in a new key?
crimer at crimer90.co.cc
Tue Nov 8 16:01:05 CET 2011
-----BEGIN PGP SIGNED MESSAGE-----
2011/11/8 Adam <adam_w67 at yahoo.com>:
> when creating a new key, gpg2 creates a selfsig and a subkey which is
> selfsiged as well. Why does it do so? Why not create just a plain key
> without subkey and selfsig?
gpg2 (and gpg 1 the same) by default creates a 'certificate' with two keys,
one for signing/certifying and the other for encryption. Actually, this
'certificate', composed by a master signing key and an encryption subkey,
is what is generally called 'key'.
There are some reasons behind this choice, I think the main one is because
it's safer to manage different keys for different needs. You can have only
a signing key for authenticate the messages you sent and, at the same time,
have more than one encryption key to enhance your security.
You can, for instance, revoke an encryption key if you think it's
compromised or if you want to change it because it's superseded or what
you want... while keeping working your signing one, validating what you
About the self-signature:
Your 'certificate' is an association between your cryptographic keys and
your identities. The self-signature is what makes this 'magic' work, thus
binding the two in a strong and verifiable relationship.
Without it, someone could, for example, add other uids to your key without
any problem, and it could be dangerous for the whole functioning of the
web of trust.
There's also a 'key-binding signature' between your master key and your
subkeys, for the same important reason.
Hope it helps. :-)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
-----END PGP SIGNATURE-----
More information about the Gnupg-users