Re: Regeneration of gpg keys after HeartBleed

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--SMeR5KqiUP2vSlbTI6nEswtT6g4kvFRhi
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On 09.04.2014 18:39, Jo wrote:
> Hi all, this is my first post in this list, so again Hi all!
>=20
> I'm a bit concerned about the signing keys of the portage tree releases=
,
> I know that gpg is not the same as openssl but keeping in mind that SSH=
,
> VPN, HTTPS keys might be compromised for two years, don't you think it'=
s
> a healthy measure to generate a new pair of keys?

GPG private keys are kept and used nowhere near any server processes,
not transferred via HTTPS or any VPNs, and SSH is not affected. I don't
see an immediate need to rotate them.

--=20
Alex Legler <[email protected]>
Gentoo Security/Ruby/Infrastructure


--SMeR5KqiUP2vSlbTI6nEswtT6g4kvFRhi
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCAAGBQJTTFknAAoJEDa6ZWES7jAAIZkQALdsVFXDvJMLO5uZ6pf76+XN
UCdbsY/Xl0qU/w0M3p2+ROr+SkJJVSh96ZQLIS2q8BWpAZii2qpOgHnEp0c7fzgM
OJ1JrhBZNG/w5ehz4pTv6gQyMD0UmXBawwQk8ob24xrAkrfBt8izZIL0Q9kqaeoE
tEVHzv41eFbEK/+kRnPcJauAXr7AoTSErgmhZSHj2x9nc5DMYk2UlFYsTYM/wbzE
o2ApMdILfFY9eMktdhiKsLnYcTslbNQ+sC0WYHMOdfM3/ULjhU3EwQP9UlAFZRce
y7zQde/OZ1QgChDJ1YAzNZkYppNKY0cc529e9EvnFzzYDiLbBijRrbW/jtjtMrJp
UmH8MGKnP3GtqPNq/BGzeFHDcaVz0jp4bj5XHLWWFiNOzc0+M53OwfvML53HBrHo
JCTbCRRR6/gcddEzsudAGqRSFsTDzDBaEfqI77PUkGrLu/TEvq0frxcEIwOtu7FP
PTXk1QU7Olw1/RnOVb6Ar0AR7lnZH59SQeSdRhhDaRMH0nNK2TArQMfuUm9Zxrkv
Yxw7xEJ5Xu950C45ApswutUSpOXUUjQJ2kdJ8r93vrqbEt0+tFkuxvPRerm4xpXg
11DrMb0LH+kOf4I5sz6yaPorLMg1S03OrRrO/prSNI5QU9gYvfy0v8ALJyhLAe+j
OPKjea1Gm9vJKsYTv3bH
=KGO2
-----END PGP SIGNATURE-----

--SMeR5KqiUP2vSlbTI6nEswtT6g4kvFRhi--