linux-kernel - Re: kernel.org status: establishing a PGP web of trust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 1 Oct 2011 15:26:59 -0700
From:	Greg KH <greg@...ah.com>
To:	"Rafael J. Wysocki" <rjw@...k.pl>
Cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	"H. Peter Anvin" <hpa@...or.com>
Subject: Re: kernel.org status: establishing a PGP web of trust

On Sun, Oct 02, 2011 at 12:07:45AM +0200, Rafael J. Wysocki wrote:
> On Saturday, October 01, 2011, Greg KH wrote:
> > On Fri, Sep 30, 2011 at 04:50:37PM -0700, H. Peter Anvin wrote:
> > > 2. Create a new PGP/GPG key, and also generate a key revocation
> > >    certificate (but don't import it anywhere -- save it for the
> > >    future) for your new key.  In the near future we are considering
> > >    setting up an escrow service for key revocation certificates.
> > > 
> > >    I recommend using a 4096-bit RSA key.  Given how fast computers are
> > >    these days, there is no reason to use a shorter key.  DSA keys
> > >    should be considered obsolete; substantial weaknesses have been
> > >    found in DSA.
> > > 
> > >    $ gpg --gen-key
> > >    $ gpg -u <key ID> -o <key ID>.revoke --gen-revoke
> > 
> > I would recommend a physical access device for your new gpg key that you
> > create.  I've heard good things about this USB device:
> > 	http://www.crypto-stick.org/
> > and am trying to have a bunch of them at the Kernel Summit this year to
> > hand out to people if they want one.
> 
> This thingie is only capable of operating keys up to 3072-bits it seems.

For older versions of gpg, yes, as of gpg version 2.0.18 it can handle
4k bit keys, so all should be fine.  Read deeper on the site, it says
this somewhere there.

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/