vanitasvitae/openpgp-notes
1
0
Fork 0
mirror of https://codeberg.org/openpgp/notes.git synced 2024-11-23 08:02:05 +01:00
Code Issues Projects Releases Packages Wiki Activity

resolve https://codeberg.org/openpgp/notes/pulls/81#issuecomment-1317436

Browse source
This commit is contained in:
Tammi L. Coles 2023-11-03 10:35:36 +01:00
parent 783b151af6
commit 8fc4302338
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
book/source/04-certificates.md
View file

@ -114,7 +114,9 @@ Commonly used key flags include:
- **Authentication**: primarily used for OpenPGP authentication
```{note}
Distinct component keys handle specific operations. The primary key is reserved solely for certification, while separate subkeys are used for signing, encryption, and authentication. Subkeys lack certification capability. Notably, in many algorithms, encryption capability is exclusive and cannot overlap with other operations[^key-flag-sharing]).
Distinct component keys handle specific operations. Only the primary key can be used for certification, although it can have additional capabilities. Subkeys can be used for signing, encryption, and authentication but cannot have the certification capability. It is considered good practice, however, to [use separate keys for each capability](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#section-10.1.5-7).
Notably, in many algorithms, encryption and signing-related functionalities (i.e., certification, signing, authentication) are mutually exclusive, because the algorithms only support one of those two families of operations[^key-flag-sharing]).
```
[^key-flag-sharing]: With ECC algorithms, it's impossible to combine encryption functions with those intended for signing. For example, ed25519 is specifically used for signing; cv25519 is designated for encryption.