Hacker News Reader

Comment by LamGC | Hacker News Reader

I am currently developing a great encryption tool for long-term highly confidential files in the post quantum era, but I am still concerned about any issues with it, so I am personally using it for a period of time to prove that this tool can be released as open source! (I plan to personally use it to encrypt and backup some of my GPG keys offline, then burn them onto M-DISC discs and store them in a bank safe)

View on HN

> I plan to personally use it to encrypt and backup some of my GPG keys offline, then burn them onto M-DISC discs and store them in a bank safe

Won’t that make it difficult to rotate your keys?

Keys should be something you don’t hesitate to throw away and rotate at the first hint of a compromise.

My GPG key is renewed expire date every 2 years, and the main key and sub key are separated (the main key is stored offline, and the sub key is on YubiKey). The private key does not need to be updated regularly, so it can be directly encrypted and saved in the backup.

I think this is a good balance point, and I estimate that if we want to rotate the keys completely in the future, we should start using new key algorithms. (I estimate it will take another 5-8 years)

> Keys should be something you don’t hesitate to throw away and rotate at the first hint of a compromise.

Yes, when certain situations arise, it is necessary to rotate the keys as soon as possible, but in the absence of such situations, losing key backups can be catastrophic.

Reply on news.ycombinator.com