1

I have a number of devices running on Ubuntu trusty, syncing with a custom Debian package repository for software updates via unattended-upgrades. However, the OpenPGP key used to sign the release file expired before I noticed. Now the devices cannot automatically update the OpenPGP public key and authenticate the packages, and can no longer upgrade to the latest packages available in the repository. Is there anyway to salvage from this situation without manually running any commands on the devices? What is the standard set-up to enable gpg key rotation (without future intervention on the client devices)?

1 Answer 1

0

If you've still got access to the private key, you can easily extend the validity period running gpg --edit-key [key-id] and then using the expire command. This way, you should manage to have the old machines "pick up" on updates again, and then project the actual key escrow. Also read "Does OpenPGP key expiration add to security?" (edit: I overlooked that the key needs to be updated on the clients, which won't happen automatically).

A common "OpenPGP way" to deal with with rather frequent (more often than all decade) key escrow on a given schedule is keeping the primary private key offline (for example, on a dedicated computer not connected to the internet) and not escrowing it, while actual signing is performed by a signing subkey which you can escrow easily without losing trust on the machines (and you can have multiple valid ones at the same time).

As an alternative, you could install a new trusted OpenPGP key before the old one will expire.

5
  • Thanks! Still, how would the devices learn about the changed expiration date? I am not using a key server to host the public key. The public key is stored at a public url. Do you mean that once the archive becomes signed by the key with extended validity period, without running any command on the devices to download and import a public key with the new expiration date, the devices will be able to learn on itself about the new expiration date and accept the archive?
    – cape
    Apr 9, 2016 at 18:53
  • I extended the key validity period and signed the archive with the edited key, but when I ran apt-get update (without explicitly updating the public key) on my device, I hit KEYEXPIRED errors.
    – cape
    Apr 10, 2016 at 4:45
  • You're right, I'm sorry and overlooked the issue the key update isn't pulled automatically. I just tested whether backdated releases might work out, but apt-get update refuses all signatures by outdated keys, not only those issued after the key expired. I'll leave the answer around as it at least partially discusses relevant parts, but will mark the first paragraph as not really working out.
    – Jens Erat
    Apr 10, 2016 at 8:02
  • If you set up your own time server, you can do some very nasty hack and change the devices back the time when the key still was valid.
    – Jens Erat
    Apr 10, 2016 at 8:09
  • Thanks Jens. Your answer is still very informative. In the future, after fixing the problem this time, to perform key rotation I might use the master-sub key approach, and try pushing a package containing new keys (while the current key has not yet expired), and configure the keyring in the packages' postinst script.
    – cape
    Apr 11, 2016 at 18:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .