Subject: Limited utility of master/subkey

From: "Michael Young" <[email-masked]>
Date: Wed, 7 Feb 2001 00:51:32 -0500

-----BEGIN PGP SIGNED MESSAGE-----

Does PGP7 or GnuPG provide the ability to use a separate
passphrase for the master key and its subkeys?  I'd like to
use my master key rarely, for key-signing only, and protect
it with a passphrase that I almost never use.  I'd then use
(limited-lifetime) subkeys for everyday decryption.
Ideally, I'd be able to make a subkey for everyday signing
of messages.  The OpenPGP specification would appear to
allow this, but I don't see any commands for doing so in the
implementations.

As an experiment, I generated such a master/subkey set and
imported it into PGP 6.5.3.  I found that it couldn't decrypt
material encrypted to the encryption subkey.  I then tried
the passphrase-changing dialog, and it (quite reasonably)
complained about "the" passphrase being incorrect, but it
did change the master's passphrase.  Even though I had
changed the passphrases to match, I was unable decrypt until
I went through the passphrase-changing dialog yet again.

So, unless I'm missing something, it doesn't look like this
is possible.  I also see no way to generate a signing subkey.
Yes, I can create a completely separate key-signing key,
but this gives up the values of the master/subkey (notably,
being able to accumulate signatures on master/userId
relationships that automatically apply to all subkeys).
The very limited coupling available in the implementations
just doesn't buy very much.

Any thoughts?

---

From: Werner Koch <[email-masked]>
Date: Wed, 7 Feb 2001 14:54:04 +0100

> passphrase for the master key and its subkeys?  I'd like to

GnuPG in part.  If the subkey's passphrase is different it will ask
you for this passphrase.  However, it is not possible to set a
different passphrase for a subkey.

There is a hack which allows you to create a secret key without a
usable primary key:  grep the FAQ for --export-secret-subkeys

> Yes, I can create a completely separate key-signing key,

You can do this with GnuPG, but there are probably some problems
using this sign-only subkey: currently GnuPG favors the primary key
for this.  This will be changed soon.

Ciao,

  Werner 

-- 
Werner Koch                                              <[email-masked]>
GNU Privacy Guard                                (http://www.gnupg.org)
Free Software Foundation Europe              (http://www.fsfeurope.org)
           [Please see X-* mail header for OpenPGP key info]

---

From: [email-masked] (Clive Jones)
Date: Thu, 8 Feb 2001 01:10:59 GMT

"Michael Young" <[email-masked]> wrote:
> of messages.
[...]
> Any thoughts?

I don't think what you're trying to do is a good idea.

The basic premise is that you want to keep your key-signing key more
secure than your everyday decryption and message-signing keys. You
propose to do this by giving your key-signing key a different
passphrase - presumably one that is more secure?

You are naturally remembering passphrases rather than writing them
down, since you care about security so much. Since you can remember
the more secure passphrase, why not enjoy greater security by using
that passphrase for everything, rather than using a weaker passphrase
for the other parts?

- It means there are two passphrases to crack not just one.
    Not true. Anyone who obtains your key-signing key and determines
    its passphrase gains the authority to replace your message-signing
    and decryption keys, which is almost as useful to them anyway.
- It means that if your everyday passphrase is captured by a keyboard
  sniffer, your key-signing passphrase is still safe.
    True. On the other hand, you are still presumably going to use
    your key-signing passphrase on occasion, and your computer will be
    no more secure against sniffing when you do; anyone who is able to
    capture passphrases you type will probably get both.
- The everyday passphrase can be easier to type.
    True - just about the only thing I can see in favour of the
    scheme.

Remember that, of the passphrase and the secret key, the passphrase is
the weaker element of your protection from impersonation. If you are
taking extra precautions with your key-signing key, you should
seriously consider keeping it on a floppy or similar, rather than
leaving it on your PC - this is a much more significant improvement in
security than using a different passphrase.

If you're going to keep your key-signing secret key offline, you want
to be able to split apart the different secret subkeys of a key, too.

Isn't it far simpler just to make a separate key-signing key, rather
than looking for a way to do this with subkeys? This is certainly a
method a lot of people have used for years.

--Clive.

---

From: "Michael Young" <[email-masked]>
Date: Thu, 8 Feb 2001 01:06:39 -0500

-----BEGIN PGP SIGNED MESSAGE-----

> I don't think what you're trying to do is a good idea.

I appreciate your concerns, but I do not share your conclusions.

The care I take with a key and its passphrase *is* related to its
value, which is in turn related to its lifetime.  I may use a simpler
passphrase for a key that deals with short-term messages than ones
that guard other personal data or that signs other keys.  I also
attach a shorter expiration time to those less valuable keys.
I also believe that the more a key is used, the greater chance
of a compromise to due malice *or accident*.
         
The ability to generate new subkeys seems to match my model.
If my subkey were always as valuable as my master key, why would
I ever generate another subkey?

If the keys have different values, why is it unreasonable to
allow different passphrases?  No, it's not the only (or even
best) way to mitigate risk, but I believe it can help.

> method a lot of people have used for years.

I am doing just that.  The *only* reason that it is simpler is that
the tools have this limitation.  This requires that human beings
recognize that these keys are related (or grant my key-signing key
greater trust than otherwise necessary).

When PGP moved to DSA/DH, this could have been the solution: simply
have two independent keys.  That would have been just as unwieldy.
The master/subkey approach recognizes the utility in the tools
understanding a relationship between the keys.  That utility does not
depend on the keys having equal value -- in fact, it suggests the
opposite -- nor does it depend on them having the same passphrase.

I'm not suggesting that the tools shouldn't make it easy for someone
to use the same passphrase for all the related keys -- clearly that
suits most people's needs.  I'm simply suggesting that they should
allow for more advanced use.  And certainly, when faced with
an imported OpenPGP-compliant master/subkey group with different
passphrases, it ought to behave reasonably.

And for what it's worth, GNUPG does behave.  (Thanks, Werner :-).
PGP6 does not.  I can't buy a personal PGP7 yet (or see source),
so for it, I can't say.