Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Do I have to keep the revocation certificate of my OpenPGP key in a safe place or may I place it in e.g. Dropbox to have it ready on all my machines?

I know that, if compromised, the certificate can be used by anyone to revoke my key. I am just assuming my Dropbox/whatever place is reasonably secure from unallowed access.

share|improve this question

migrated from crypto.stackexchange.com Aug 22 at 11:44

This question came from our site for software developers, mathematicians and others interested in cryptography.

1 Answer 1

Anybody with access to your revocation certificate is able to revoke your key, with you losing all reputation in the OpenPGP web of trust in consequence (but that's it, he will not gain access to your private key).

You can put it anywhere you like – it might just not be reasonable. How bad this would be and how much the gain of a less secure storage would be is your decision. Anyway: be aware you will (hopefully) never need it. Though, if you have to expect your key to be stolen at any time with a reasonably high chance, it might be a good idea to have the revocation certificate at hand all time. You will have to find the balance between availability and security, where exactly to go depends on your needs and must be your decision.

Cloud hosters should never be considered save nor trustworthy.

I'd recommend to additionally create a QR code with the certificate, print it a few times and store it in your bank safe or with somebody you trust, for example your parents. You can create such a QR code using gpg --armor --gen-revoke [Key-ID] | qrencode (probably you will add some options, but make sure to print it next to the code, just in case...).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.