5

When I first created by PGP keypair, my identity was unfortunatly self-signed using SHA1.

I later signed again using SHA512.

Does it make sense to revoke the SHA1 signature now or will that just clutter up the keyserver?

1 Answer 1

3

First of all, this will not require you to revoke the user ID/identity, you can simply add a newer self-signature superseding the old, SHA-1 based signature.

I wouldn't care about the old signature. On one hand, self-signatures can be reissued as you want to, in fact they're reissued whenever you change the key preferences (those are stored in self-signatures), while the newest is to be considered the "valid" one.

Don't care about cluttering the key server network. Adding a revocation is just one more signature (or rather, one per user ID), this is no notable change for the key servers (there are thousands of new certifications each day).

But would it make sense? Well, a revocation usually explains something's fishy about the revoked signature. It was issued by mistake, you realized after some time that it was issued on wrong assumptions, the certification was not issued by you (although you'd probably rather revoke the whole key in this case).

SHA-1 might not prove secure enough in the near future. What does this mean for self signatures? You should not trust SHA-1 signatures at all any more in this case, as each of them could have been issued by an attacker. If you revoke your old SHA-1 signature, this will still not prevent an attacker from issuing new faked certifications. You generally only should consider trustworthy signatures, and ignore all others. I wouldn't treat untrustworthy self-signatures differently from ones issued by untrusted keys or weak algorithms, and simply ignore them.

All in all: the important part is you do have a trustworthy, new self-signature. The old one does not really matter any more, revoke it if you want, keep it if you don't want to clutter your key listing -- or are too lazy.

1
  • 1
    "SHA-1 might not prove secure enough in the near future" right you were (though not surprisingly): shattered.io Commented Mar 16, 2017 at 7:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .