If I'm a trusted user in the web-of-trust but my private key gets stolen by Eve, how would other users find out that my key is compromised and thus cannot be trusted anymore? Is there a way for them to find out and revoke the key?


You can publish the revocation certificate. Ideally, you should've generated a revocation certificate while you generated the key pair, so that you can still revoke even if you later lose access to the private key. If not, you can generate the revocation certificate as long as you have access to the private key.

When you publish a revocation certificate, your users have to download the revocation certificate before they'd notice that your key should no longer be trusted. They can do this by syncing their keyring with the key server where you've published your revocation certificate.

  • But how can they trust your claim that you actually lost the key? What if Eve impersonates you and claims that you lost the key even when you didn't and thus make Eve a trusted user in the ring? – kchoi Jul 29 '18 at 16:31
  • A revocation certificate is cryptographically signed, so only someone who had access to the private key can generate a valid revocation certificate. If your attacker revokes your certificate for you, then it's really their loss, as neither of you now can use the key. You really shouldn't keep using a key that's known to be compromised anyway. – Lie Ryan Jul 29 '18 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.