PGP

My current and past PGP keys are listed below. Note that I rotate my keys (including the primary key) regularly. Additionally, I have a Protonmail account. It is not simple to use a Protonmail account with an external PGP key, so my emails are only signed by Protonmail for the time being. You can download my public key here .

• Current Key

  • BB134B1B441D664FFDE5487F37FCE2D8602C2576 openpgp ubuntu

    • Encryption subkey: 35DA29D9947E7E8BFF2DBE6659A30877F853799C
    • Signing subkey: 4F6C2685F73C75F3E64C8F3B2F8EB39B412FAEE4

• Old Keys

  • 00460FBFDE81F2094BDCC1E122B7D8893673C887 openpgp ubuntu

    • Encryption subkey: D1E6C9987341ADBFA9B66CD2E06EED90EEF15AAA
    • Signing subkey: B97AD00EC6DD241003E718D3BB8FCE71E0EB43F9

• Potentially compromised keys (incident report)

  • ADB0F8060C23A23001177BBF0A97247DCBEDCCF7

  • 765DDDB3ABF2D795FBDCF0A082DD56008CA1F52C

I manage my PGP keys in an atypical manner. Most notably, I do not use long-lived PGP keys. I use subkeys in order to make it easier to work with my smartcard: it expects 3 separate keys for signing, encryption, and authentication. It might be technically possible to upload the same key in all slots (I have not tried), but this would be inconvenient because GPG wants to delete the key after it has been uploaded. I do not consider the primary key to be any more secure than the subkeys. I rotate my keys at least annually, and may rotate them sooner than the expiration date.

Rotating keys causes some incompatibility with current systems, which expect the same key to be used for years, decades, or even an entire lifetime. I will do what I can to accommodate these incompatibilities, for example by signing an email which contains a commit rather than signing the commit itself.

Key rotation is a three-step process:

1. Create the new key
2. Sign the new key with the old key
3. Revoke the old key

This creates a single line of keys which increases confidence that the keys are legitimate. If there is ever a branch in the line, something has gone wrong. Currently, a branch means that someone has uploaded a key in bad faith (and if it is signed, the signing key has been compromised).

I do not have any other signatures on my keys because the people in my life who are physically present do not use PGP, and asking for a signature through digital communication is problematic. In order to help build confidence in the key, I now validate my email address with the openpgp keyserver. If this bothers you, read this before you yell at me.