2

I've published my OpenPGP key publicly on the MIT key server. Later I realized I needed to set the expiry date to an earlier date than the one the (sub-)key was published with.

I managed to do this locally, but after I pushed the updated key to the server, it shows up as having two subkeys with the same ID. One of them has the old expiry date, and the other one has the correct new one. My local keychain still reports having only one subkey.

  • Why has this happened? Shouldn't the old key just get replaced with the updated one?

  • Can I be sure that my published key will expire on the new correct date that I set?

Improve this question

1 Answer 1

Reset to default
1

Why has this happened? Shouldn't the old key just get replaced with the updated one?

In OpenPGP (at lest for version 4 keys), the expiry date in not stored in the key packet itself, but in binding signatures (self signatures) on the keys. Changes to the expiry date (and other attributes) are performed by distributing a never version of the binding signature, which then superseeds the old one.

As key servers only do partial verification of signatures (if any), they keep all versions around and have the OpenPGP clients perform verification (and choose the newest valid binding signature and thus expiry date). Furthermore, it offers a kind of history of the key.

This was also discussed some years ago on the GnuPG mailing list, also linking an example showing the duplicated binding signatures that occured because of changing the expiry date:

sub  1024D/2D16624C 2003-05-13            
sig sbind  FFFD5DA0 2003-05-13 __________ __________ []
sig sbind  FFFD5DA0 2003-05-14 __________ 2007-05-13 []
sig sbind  FFFD5DA0 2011-03-06 __________ 2013-05-13 []

OpenPGP clients like GnuPG will usually discard (or hide) the older versions after verifying the binding signatures.

Can I be sure that my published key will expire on the new correct date that I set?

Yes, OpenPGP clients will follow the newest self signature available, and consider the older ones superseded.

Improve this answer
1
  • Very well and precisely explained. I noticed all your answers related to GPG/GnuPG issues are (may be the most) reliable. Thank you for sharing your knowledge.
    – user45139
    Commented Sep 3, 2015 at 6:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .