0

My GPG private key never expires. I know I will lose it eventually when my hard drive crashes and I will generate a new one.

But I care to backup my GPG public key in numerous places. So if I lost my GPG private key someday, would my Git signature be still verifiable forever?

Mark Adelsberger
  • 42,148
  • 4
  • 35
  • 52

1 Answers1

1

The words "cryptography" and "forever' don't go together. The encryption used in today's GPG signatures will eventually not be strong enough to verify anything. (A flaw in the algorithm will be exploited, or technology will change so that reversing the process is simply no longer computationally prohibitive, or something else will happen.)

But within the intent of your question, losing your private key will not be a reason why existing signatures become unverifiable. (Unless by "lose" you mean 'leave where it is no longer secret".) Verifying a signature doesn't involve the private key - if it did, nobody could do it, because the private key is private. Or to put it differently, if I use your public key to verify your signature on some work, I have no way or reason to know or care where (or if) you have a copy of the private key.

It will mean that you can no longer sign anything new with that key, and your solution of 'eh, I'll just make a new key pair" will be something of a nuisance to anyone who wants to verify your authorship (since now they have to have two public keys and be able to apply the right one to the right work). So maybe while you're backing things up, back up the private key in a secure way as well.

Mark Adelsberger
  • 42,148
  • 4
  • 35
  • 52