[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Having more than one key in the Debian keyring



On Fri, Aug 08, 2003 at 10:49:43PM +0200, Marc Haber wrote:
> On Fri, 8 Aug 2003 15:11:58 -0400, Kyle McMartin
> <kyle@gondolin.debian.net> wrote:
> >Why are you replacing your key?

> Change of $ORKPLACE, and a b0rken key policy regarding the old one. I
> wouldn't say the old key is probably compromised, but I feel better
> with an entirely new key created in a well-known "clean" environment.

"I think there are people in the world that are capable of compromising
my key" is not a good reason to remove your old key from the keyring;
and "my key has been compromised because of the way I managed it while
working for Foo, Inc." is not a good reason to allow you to upload a new
key to the ring (why should the keymaster think you won't handle your
new key the same way?).  I think this is part of why it's so hard to get
a new key into the keyring: there are very few reasons for wanting to
replace a key that don't reflect poorly on the maintainer.

> >Alternatively, why can't you just
> >revuid or revkey the (uid/subkey)?

> I would end up without a valid key in the Debian keyring for months
> since it is well known that it takes months to get a new key into the
> Debian keyring - as usual with paranoia related roles in Debian (DAM,
> ftpmaster) without any form of traceable feedback.

And this reflects poorly on your knowledge of PGP.  Revocation of a
non-Debian uid, or of a subkey other than the one you use for uploads to
Debian, has no effect on the usability of the key for uploads.  Of
course, if you didn't /create/ a subkey for your work-related use, we
come back to the question of the fitness of past and future methods of
personal key management.

Were I the keymaster (and I'm not), I would expect anyone asking to
replace their key in the keyring to provide a very detailed explanation
of why this is necessary, as well as providing concrete assurances that
this will not be necessary in the future (i.e., explaining what steps
you've taken to prevent future problems).

-- 
Steve Langasek
postmodern programmer

Attachment: pgpNOHkXZpPB2.pgp
Description: PGP signature


Reply to: