Re: kernel.org status: establishing a PGP web of trust

Greg KH
2011-10-01T22:27:33Z

On Sun, Oct 02, 2011 at 12:07:45AM +0200, Rafael J. Wysocki wrote:
> On Saturday, October 01, 2011, Greg KH wrote:
> > On Fri, Sep 30, 2011 at 04:50:37PM -0700, H. Peter Anvin wrote:
> > > 2. Create a new PGP/GPG key, and also generate a key revocation
> > > certificate (but don't import it anywhere -- save it for the
> > > future) for your new key. In the near future we are considering
> > > setting up an escrow service for key revocation certificates.
> > >
> > > I recommend using a 4096-bit RSA key. Given how fast computers are
> > > these days, there is no reason to use a shorter key. DSA keys
> > > should be considered obsolete; substantial weaknesses have been
> > > found in DSA.
> > >
> > > $ gpg --gen-key
> > > $ gpg -u <key ID> -o <key ID>.revoke --gen-revoke
> >
> > I would recommend a physical access device for your new gpg key that you
> > create. I've heard good things about this USB device:
> > http://www.crypto-stick.org/
> > and am trying to have a bunch of them at the Kernel Summit this year to
> > hand out to people if they want one.
>
> This thingie is only capable of operating keys up to 3072-bits it seems.

For older versions of gpg, yes, as of gpg version 2.0.18 it can handle
4k bit keys, so all should be fine. Read deeper on the site, it says
this somewhere there.

greg k-h