SQ(1)

NAME
sq key subkey add - Adds a newly generated Subkey

SYNOPSIS
sq [GLOBAL OPTIONS] key subkey add [OPTIONS] FILE

DESCRIPTION
Adds a newly generated Subkey.

A subkey has one or more flags. "--can-sign" sets the signing flag, and means that the key may be used for signing. "--can-authenticate" sets the authentication flags, and means that the key may be used for authentication (e.g., as an SSH key). These two flags may be combined.

"--can-encrypt=storage" sets the storage encryption flag, and means that the key may be used for storage encryption. "--can-encrypt=transport" sets the transport encryption flag, and means that the key may be used for transport encryption. "--can-encrypt=universal" sets both the storage and the transport encryption flag, and means that the key may be used for both storage and transport encryption. Only one of the encryption flags may be used and it can not be combined with the signing or authentication flag.

At least one flag must be chosen.

Furthermore the subkey may use one of several available cipher suites, that can be selected using "--cipher-suite".

By default a new subkey never expires. However, its validity period is limited by that of the primary key it is added for. Using the "--expiry=EXPIRY" argument specific validity periods may be defined. It allows for providing a point in time for validity to end or a validity duration.

"sq key subkey add" respects the reference time set by the top-level "--time" argument. It sets the creation time of the subkey to the specified time.

OPTIONS

  Global options

--cert-store=PATH
    Specifies the location of the certificate store

-f, --force=FORCE
    Overwrites existing files

--keyring=PATH
    Specifies the location of a keyring to use

--known-notation=NOTATION
    Adds NOTATION to the list of known notations

--no-cert-store=NO_CERT_STORE
    Disables the use of a certificate store

--output-format=FORMAT
    Produces output in FORMAT, if possible

--output-version=VERSION
    Produces output variant VERSION.

--pep-cert-store=PATH
    Specifies the location of a pEp certificate store

--time=TIME
    Sets the reference time as ISO 8601 formatted timestamp

--trust-root=FINGERPRINT|KEYID
    Considers the specified certificate to be a trust root

  Subcommand options

-B, --binary=BINARY
    Emits binary data

-c, --cipher-suite=CIPHER-SUITE
    Selects the cryptographic algorithms for the subkey

--can-authenticate=CAN_AUTHENTICATE
    Adds authentication capability to subkey

--can-encrypt=PURPOSE
    Adds an encryption capability to subkey [default: universal]

--can-sign=CAN_SIGN
    Adds signing capability to subkey

--expiry=EXPIRY
    Defines EXPIRY for the subkey as ISO 8601 formatted string or custom duration.

-o, --output=FILE
    Writes to FILE or stdout if omitted

--private-key-store=KEY_STORE
    Provides parameters for private key store

EXAMPLES

First, this generates a key

    sq key generate --userid "alice <alice@example.org>" --output alice.key.pgp

Add a new Subkey for universal encryption which expires at the same time as

the primary key

    sq key subkey add --output alice-new.key.pgp --can-encrypt universal alice.key.pgp

Add a new Subkey for signing using the rsa3k cipher suite which expires in five days

    sq key subkey add --output alice-new.key.pgp --can-sign --cipher-suite rsa3k --expiry 5d alice.key.pgp

SEE ALSO
sq(1).

For the full documentation see <https://docs.sequoia-pgp.org/sq/>.

VERSION
0.31.0 (sequoia-openpgp 1.16.0, using Nettle 3.9 (Cv448: true))