Comment by stackghost
1 hour ago
> I plan to personally use it to encrypt and backup some of my GPG keys offline, then burn them onto M-DISC discs and store them in a bank safe
Won’t that make it difficult to rotate your keys?
Keys should be something you don’t hesitate to throw away and rotate at the first hint of a compromise.
My GPG key is renewed expire date every 2 years, and the main key and sub key are separated (the main key is stored offline, and the sub key is on YubiKey). The private key does not need to be updated regularly, so it can be directly encrypted and saved in the backup.
I think this is a good balance point, and I estimate that if we want to rotate the keys completely in the future, we should start using new key algorithms. (I estimate it will take another 5-8 years)
> Keys should be something you don’t hesitate to throw away and rotate at the first hint of a compromise.
Yes, when certain situations arise, it is necessary to rotate the keys as soon as possible, but in the absence of such situations, losing key backups can be catastrophic.