keybase / keybase/keybase-issues

Expiry Date of generated Keys by Keybase

Open
#952 1 comment 3 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

When testing the signature for Issue #951 I noticed that the expiry date for the master key is indefinitely (this has also been mentioned in #719)
On the other hand nearly every Best Practice ever written advise strongly against it and recommend expiry dates shorter than two years (see randomly picked [[1]](https://help.riseup.net/en/security/message-security/openpgp/best-practices#use-an-expiration-date-less-than-two-years)), since the validity can be extend whenever you like even if it has already expired.

The subkeys on keybase.io already use the 2 years scheme so there have to be some sorts of ideas what do do on keybase site (at least for hosted private keys) what to do with them when the time has come. I imagine keybase prompting the user to unlock the key for automated expansion of the expiry date.

Since the process of lengthening the key lives is no different for the master keys than the subkeys I propose that the master keys follow this scheme as well.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the related issues #951 and #719, then examine how Keybase currently handles master keys, subkeys, hosted private keys, and expiry extension. Done should include a defined expiry policy for generated master keys and a clear approach for extending them when they expire.

Written by the indexing model from the issue text.

Assessment

Domain
cryptography, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.