Jose Simoes wrote:
> (a) sub-keys are created in pars (private+public) or just one key at
> a time.
Pairs.
> (b) can any sub-key be used to encrypt AND to sign documents?
What do you mean by 'any'? English is unfortunately ambiguous here.
If you mean "do there exist subkey types that can encrypt and sign
documents", yes, RSA subkeys can do this. However, this behavior is not
recommended.
If you mean "can all subkeys, regardless of type, be used to encrypt and
sign documents", then no. Some algorithms are sign-only (DSA). Even
RSA subkeys can be marked as "encrypt-only", "sign-only", and/or
"certify-only". Most of the time RSA subkeys are marked as
"encrypt-only" or "sign and certify only".
> (c) Can sub-keys share the same password / phrase with the main key
> and other sub-keys ?
They always do.
>; (d) If I have a valid (main) public + private encrypted key +
> appropriate password can I generate any number of sub-keys with any
> time limit and anytime I want?
There's going to be _some_ limit, but it's very unlikely to be one
you'll reach in practice. You'll find your correspondents asking you
";why, man, _why_ do you have 4,000 subkeys?!" long before you reach the
subkey limit.
> (e) Someone with 2 different of my (public?) sub-keys and its
> fingerprints has a good change of find out the are sub-keys of the
> same key?
Subkeys only exist in connection with the main key. So yes, this is
pretty much guaranteed.
> (f) Can I use a expired sub-key (knowing the encrypted sub-key and
> the password) to decrypt or check the signature of a document -
> probably encrypted or signed long ago when when the key was valid ?
Yes. You'll get a warning message, but it will still decrypt and/or
verify. You just can't use an expired subkey to encrypt and/or sign a
message, not without a certain amount of work and tweaking.
> (g) If some one signs my main key is it necessary to signed any sub-
> key (more: and if the sub-key was created after the signature?) .
Other people sign your user identities, not your subkeys. Thus, this
question really can't be answered, since it's predicated on a
misunderstanding of key signatures.
> (h) Can I create a revocation certificate for a sub-key if I lost
> the sub-key (but still have everything about the main key).
Unknown, but I believe so.
Hope this helps!
.
