Improve documentation for gpg subkey creation

[glensc]

Q	A
Documentation	yes
Bugfix	yes/no
BC Break	yes/no
New Feature	yes/no
RFC	yes/no
QA	yes/no

Description

This updates GPG section to match my system (gpg (GnuPG) 2.2.25 from brew).

[glensc]

Type addkey and select signing or s for capabilities. RSA key type is recommended for greatest compatibility. Type save to persist the new subkey to your master key. Make a note of the Key ID as you will need it in the next step.

I'm confused here, "s" is supposed to be key to type? i have only numeric answers:

gpg> addkey
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
  (14) Existing key from card
Your selection? s
Invalid selection.

[glensc]

Next, I also get asked about bits:

RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072)

So what's the recommendation here for git signing in github?

From https://en.wikipedia.org/wiki/Key_size I read:

Since 2015, NIST recommends a minimum of 2048-bit keys for RSA, an update to the widely-accepted recommendation of a 1024-bit minimum since at least 2002.

[Ocramius]

Your selection? s
Invalid selection.

Looks like something that has changed on newer releases: certainly want a key with signing capabilities (used to be s for sign, e for encrypt and something else for certification/authentication)

So what's the recommendation here for git signing in github?

The default of 3072 works: bigger values lead to some overhead, but overall not noticeable. My old key is still 2048, for example.

[glensc]

I've added an example commit with 2048, change to 3072?

[Ocramius]

Probably better to keep it the default suggested one: that's really up to GnuPG to endorse, while we're mostly only asking for a key, rather than endorsing values to configure one (security-sensitive stuff that we shouldn't touch)

[glensc]

If I attempt to remove password, I end up with a confusing error:

gpg> passwd
gpg: key XXXX/XXXX: error changing passphrase: No secret key

gpg> save
Key not changed so no update needed.

but in reality password was removed after passwd command, and yes, the save is unneeded.

[glensc]

@Ocramius I have nothing more to add here at this point.

[glensc]

Another ping!

[Ocramius]

@glensc thanks for improving the docs here - sorry for the massive delay!

[glensc]

@Ocramius sure, we have our own distraction demons. I planned to check out the "new key" section too but never got there.