Changing and Re-issuing Subkeys for Device Signing: Setting New Passphrases
In this article, we will discuss the process of changing and re-issuing subkeys for device signing, specifically focusing on the need to set new passphrases. This is an important topic for anyone using GPG keys for encryption and signing purposes, as it ensures the security and integrity of your communications.
Why Change a Subkey's Passphrase?
There are several reasons why you might want to change a subkey's passphrase. For example, if you suspect that your current passphrase has been compromised, or if you simply want to increase the security of your key, changing the passphrase is a good first step. Additionally, if you are sharing an encrypt subkey with multiple devices, it is a good practice to change the passphrase regularly to ensure that all devices are using the most up-to-date security measures.
Re-issuing a Subkey
Re-issuing a subkey involves creating a new subkey with the same key ID and capabilities as the old one, but with a new passphrase. This can be done using the gpg command line tool. The basic syntax for re-issuing a subkey is as follows:
gpg --edit-key [key-id]
gpg> key [subkey-number]
gpg> keygen [capabilities]
gpg> save
In this command, [key-id] is the key ID of the master key, and [subkey-number] is the number of the subkey you want to re-issue. The [capabilities] parameter specifies the capabilities of the new subkey (e.g. E for encrypt, S for sign, etc.).
Setting a New Passphrase
Once you have re-issued the subkey, you will be prompted to enter a new passphrase. It is important to choose a strong passphrase that is unique to this key. A good passphrase should be at least 12 characters long and include a mix of uppercase and lowercase letters, numbers, and special characters.
Revoking the Old Subkey
After you have successfully re-issued the subkey and set a new passphrase, you should revoke the old subkey to ensure that it is no longer used. This can be done using the following command:
gpg --edit-key [key-id]
gpg> key [subkey-number]
gpg> revoke
gpg> save
Changing and re-issuing subkeys for device signing is an important security measure that ensures the integrity and confidentiality of your communications. By following the steps outlined in this article, you can easily change the passphrase for a subkey and re-issue it with new capabilities. It is also important to regularly revoke old subkeys to ensure that they are no longer used.
References
- GNU Privacy Guard (GPG) - https://gnupg.org/documentation/manuals/gnupg/
- GPG Best Practices - https://wiki.debian.org/GnuPG/BestPractices
- GPG Keys and Subkeys - https://www.gnupg.org/gph/en/manual/x135.html