0

I'm working on an analysis of the full OpenPGP keyring (ca. 3.8 million keys). I imported all keys to a local instance of hockeypuck (keyserver implemented in go). Hockeypuck uses a PostgreSQL database and I'm working with hockeypuck's database.

At the moment I'm not sure how to figure out whether a key is revoked. According to the RFC 4880, key revocation signature types are "0x20" and "0x28". But I also found revoked keys with "0x32" and other values. I wasn't able to find a list where all signature types are explained.

Can anybody provide a short list of all signature types with a short explanation, or at least a list of signature types to identify revoked keys?

Improve this question

1 Answer 1

Reset to default
1

OpenPGP Signature Types for Revocations

All OpenPGP signature packets and their meanings are described in RFC 4880, section 5.2 (signature packet), which is the resource you already seem to have found. The relevant signature types are 0x20, 0x28 and 0x30:

   0x20: Key revocation signature
       The signature is calculated directly on the key being revoked.  A
       revoked key is not to be used.  Only revocation signatures by the
       key being revoked, or by an authorized revocation key, should be
       considered valid revocation signatures.

   0x28: Subkey revocation signature
       The signature is calculated directly on the subkey being revoked.
       A revoked subkey is not to be used.  Only revocation signatures
       by the top-level signature key that is bound to this subkey, or
       by an authorized revocation key, should be considered valid
       revocation signatures.

   0x30: Certification revocation signature
       This signature revokes an earlier User ID certification signature
       (signature class 0x10 through 0x13) or direct-key signature
       (0x1F).  It should be issued by the same key that issued the
       revoked signature or an authorized revocation key.  The signature
       is computed over the same data as the certificate that it
       revokes, and should have a later creation date than that
       certificate.

Signature Type 0x32

A signature types 0x32 is not defined. OpenPGP key servers might contain wrong (and even illegitimate) data, they to not verify it (thoroughfully): this is task of an OpenPGP client. Regarding especially the value 32 as a decimal number, which is exactly 0x20, wrong encoding the signature type magic constant seems not beyond imagination. Do revocations with type 0x32 have anything in common?

Improve this answer

You must log in to answer this question.