Which of my GPG public keys should I be publishing? Primary, subkeys, all?

Question

Original question

I have been learning about GPG and the use of subkeys. I feel I have developed a good understanding of the benefits of using subkeys and keeping your primary key offline, but there is a lack of information about which of these keys should be published. My questions:

Which keys should I be publishing?
Should I be publishing my primary key, or my subkeys, or all of them? What are the pros/cons of each?

Which keys should my friends sign?
If my friend is adding me to his keyring, does he add my primary key, my subkey(s), or all my keys? If I set up a new subkey, how can he validate that it's associated with my primary key?

How exactly are the subkeys "associated" with the primary key?
There's lots of articles saying they are associated, but none saying how. Do they contain some shared mathematical properties?

Looking forward to understanding this, would greatly appreciate any clarification that can be offered.

Update

After doing some further research, I came across this interesting article about the Anatomy of a GPG key. Judging by the information contained in this article, it would seem that subkeys are quite literally contained within the master key, at least when looking at the public key. What I hadn't originally understood was that a PGP key contains a lot of meta information, more than just the actual numerical value of the key.

Am I right in understanding that I only have one public key?
It seems I only have one public key, which would be what I publish, and what my friends sign. This is what associates my subkeys, and tells everyone that my subkeys are actually mine?

If I copy my subkeys to another device, do I take the whole public key too?
Or do the subkeys have their own sub-public keys?

Answer 1

Starting with this one:

Am I right in understanding that I only have one public key?

It seems I only have one public key, which would be what I publish, and what my friends sign. This is what associates my subkeys, and tells everyone that my subkeys are actually mine?

Yes and no. It depends on which of the multiple definitions of 'public key' you want to use.

You have one public keyblock, which most people call a "PGP public key" in the general sense. (It could be also called a "certificate".) As you've seen in the linked article, this public keyblock consists of multiple packets:

your "primary" public key parameters (the cryptographic values for RSA/DSA/etc)
├─ metadata for that public key (creation/expiry time, etc)
├─ a list of userids (name+email labels)
│  └─ each userid followed by a list of signatures (certifications)
└─ a list of "subkey" public key parameters (RSA numbers, etc)
   └─ each subkey followed by a list of self-signatures (self-certifications)

However, it's not the same thing as "one public key" in the cryptographic sense, because it has multiple sets of actual RSA/DSA/etc. public parameters inside it.

How exactly are the subkeys "associated" with the primary key?

There's lots of articles saying they are associated, but none saying how. Do they contain some shared mathematical properties?

They're stored along with a signature (self-certification) made by the primary key. Mathematically, however, they are completely independent and could be generated for different algorithms.

Which keys should I be publishing?

Should I be publishing my primary key, or my subkeys, or all of them? What are the pros/cons of each?

All of them, as a single unit (keyblock).

Each individual key is needed for its own task – the primary key has to be public as it is needed to verify signatures (certifications) you make on other people's keys (userids), and on your own subkeys and userids. The encryption subkey has to be public in order for others to actually encrypt a message to it. And so on.

Which keys should my friends sign?

In the user interface, the signing process starts by specifying your primary key (by ID or fingerprint). The software then does the correct thing.

Technically, none of the keys get signed. Other people sign your userids, which are text labels (name+email) associated with the primary key. The purpose of signing another person's key is to vouch for the binding between the key and the name+email; signing just the key alone would be useless.

If my friend is adding me to his keyring, does he add my primary key, my subkey(s), or all my keys?

Your friends add the entire key block – primary key, subkeys, userids.

If I set up a new subkey, how can he validate that it's associated with my primary key?

Your own subkeys and userids are "self-certified", i.e. they are automatically signed by your primary key as soon as you create them. This is why it's enough to distribute the fingerprint of your primary key – it acts as the verification root.