Hi, 话说 Konstantin Ryabitsev 于 2022-07-28 (四) 16:57:04 -0400 曰过： > GnuPG does not use the word "master key" when referring to the subkey > marked with the "certification" capability. Our use of this term was not > only inconsistent, but also misleading, because in real life "master > keys" are able to open multiple locks made for different keys, while PGP > Certify key has no such capability. They use "primary key" in their interface and document. For example in their .po file: msgid "Note: The public primary key and all its subkeys will be deleted.\n" msgid "using subkey %s instead of primary key %s\n" Also in gnupg/doc/gpg.texi: By specifying the key to export using a key ID or a fingerprint suffixed with an exclamation mark (!), a specific subkey or the primary key can be exported. This does not even require that the key has the authentication capability flag set. Using the new word? > > Signed-off-by: Konstantin Ryabitsev <konstantin@xxxxxxxxxxxxxxxxxxx> > > diff --git a/Documentation/process/maintainer-pgp-guide.rst b/Documentation/process/maintainer-pgp-guide.rst > index 29e7d7b1cd44..cdd108f50fe7 100644 > --- a/Documentation/process/maintainer-pgp-guide.rst > +++ b/Documentation/process/maintainer-pgp-guide.rst [...] > + > +Understanding PGP Subkeys > +------------------------- > + > +A PGP key rarely consists of a single keypair -- usually it is a > +collection of independent subkeys that can be used for different > +purposes based on their capabilities, assigned at their creation time. > +PGP defined four capabilities that a key can have: > + > +- **[S]** keys can be used for signing > +- **[E]** keys can be used for encryption > +- **[A]** keys can be used for authentication > +- **[C]** keys can be used for certifying other keys > + > +The **[C]** (certification) key is often called the "master" key, but Maybe "The key carrying the **[C]**" is better, match the following description. As your said, gpg always create a [SC] key by default. > +this terminology is misleading because it implies that the Certify key > +can be used in place of any of other subkey on the same chain (like a > +physical "master key" would). For this reason, this guide will refer to > +it as "the Certify key" to avoid any ambiguity. > + > +It is critical to fully understand the following: > + > +1. All subkeys are fully independent from each other. If you lose a > + private subkey, it cannot be restored or recreated from any other > + private key on your chain. > +2. With the exception of the Certify key, there can be multiple subkeys > + with identical capabilities (e.g. you can have 2 valid encryption > + subkeys, 3 valid signing subkeys, but only one valid certification > + subkey). All subkeys are fully independent -- a message encrypted to > + one **[E]** subkey cannot be decrypted with any other **[E]** subkey > + you may also have. > +3. A single subkey may have multiple capabilities (e.g. your **[C]** key > + can also be your **[S]** key). Reminding the limit of algorithms' capabilities by the way? Like: As long as under the algorithm's capabilities. > + > +The key carrying the **[C]** (certify) capability is the only key that > +can be used to indicate relationship with other keys. Only the **[C]** > +key can be used to: > > - add or revoke other keys (subkeys) with S/E/A capabilities > - add, change or revoke identities (uids) associated with the key > @@ -180,7 +190,7 @@ relationship with other keys. Only the **[C]** key can be used to: > > By default, GnuPG creates the following when generating new keys: > > -- A master key carrying both Certify and Sign capabilities (**[SC]**) > +- One subkey carrying both Certify and Sign capabilities (**[SC]**) I suggest to use "primary key" here. Gnupg use it in their doc, and it is really shown differently when typing --list-keys. > - A separate subkey with the Encryption capability (**[E]**) > > If you used the default parameters when generating your key, then that [...] -- Thanks, Wu XiangCheng 0x32684A40BCA7AEA7
Attachment:
signature.asc
Description: PGP signature
