Re: Regeneration of gpg keys after HeartBleed

On 04/09/14 12:01, Luis Ressel wrote:
> On Wed, 09 Apr 2014 18:39:41 +0200
> Jo <[email protected]> wrote:
>
>> I'm a bit concerned about the signing keys of the portage tree
>> releases, I know that gpg is not the same as openssl but keeping in
>> mind that SSH, VPN, HTTPS keys might be compromised for two years,
>> don't you think it's a healthy measure to generate a new pair of keys?
>
> SSL certifcates and credentials transmitted via SSL on affected servers
> should be renewed, but other than that, there's not that much to worry
> about as some people think.

It's worth a trip to http://blog.erratasec.com/2014/04/why-heartbleed-doesnt-leak-private-key.html

It's not impossible that ssl keys could be compromised, but in most cases it shouldn't happen.

Chris