up vote 0 down vote favorite
share [g+] share [fb]

We have a team (a security team) and I am wondering how could we use PGP to sign mails. People come and go of course... can't find anything about this with google.

Clarification: I would like the members to be able to send out emails that can be verified as coming from the team without giving out the single key to every member.

link|improve this question
Tons of data on this residing within the web...email.about.com/library/weekly/aa110199a.htm – Aaron Feb 17 '11 at 16:59
@Aaron: problem is not using PGP, but handling common PGP key for team. – Olli Feb 17 '11 at 18:41
@Olli The question stated..."...I am wondering how could we use PGP to sign mails..." That does not sound like it is any way geared towards how to handle the PGP key. – Aaron Feb 17 '11 at 18:48
@Aaron: well, judging from topic ("Best practices for a team using PGP key") it's more about handling PGP key. Have to wait until chx clarifies it. – Olli Feb 17 '11 at 18:53
feedback

1 Answer

up vote 1 down vote accepted

As people are coming and going, you have to either store PGP keys on some secure system where team members can't use it (as in export it for later use) or you have to regenerate it every time someone leaves.

I couldn't find any system for managing PGP keys without having local copy. For example webmail with PGP integration or PGP signing gateway would do; as long as users can't get keys, and you can manage user accounts for that system (to revoke access for members who are leaving).

If you have some kind of internal development team or some of your team members can write short program for that, adding PGP signing gateway to (authenticated, obviously) MTA is not really big task.

link|improve this answer
PGP signing gateway, hm, like djigzo? Sounds promising, thanks! – chx Feb 18 '11 at 0:15
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.