Questions about particular use cases (integrity verification w/o private key, add E flag to primary key, import secp256k1 key)

[s7r]

Robert J. Hansen wrote:
>> It works with a RSA key, but not with ECC. Try with secp256k1 and you'll
>> only get Sign and Certify capabilities. At least this is what happens on
>> my side.
> 
> I apologize for sounding like I'm condescending here: it's not my
> intent.  However, there are very important things you are apparently not
> quite understanding, so I'm going to be excruciatingly clear.
> 
> A primary key must have the Certify capability -- it's used to certify
> the subkeys, after all.
> 
> This means algorithms which can only encrypt cannot serve as a primary key.
> 
> ECC algorithms come in two varieties: ones that can sign (EdDSA, ECDSA)
> and ones that can encrypt (the rest).
> 
> So if you insist on using ECC, you must use EdDSA or ECDSA as the
> primary key.
> 
> Which means your primary key cannot encrypt.
> 
> RSA does not have this limitation.  RSA can be used for signing and
> encrypting.
> 
> This is why my example used RSA.
> 
> Use RSA.

It is not a problem at all. Thanks for the feedback and your time,
really appreciate it.

Unfortunately, I do need secp256k1 as the encryption key, this is the
reason I am asking if it can be done or not, if I could use RSA I would
not even ask, I am using RSA for so many years.

The thing is, if I create an ECC (ECDSA) secp256k1 primary key with
Sign, Certify capabilities I can also create a subkey with E capability
which is also a secp256k1 key. So, they can be used for encryption after
all, so why can't I just add E capability to the primary one..

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20170829/91a0dee3/attachment.sig>