GnuPG sub-keys revocation

Question

My current GnuPG key schema is the one recommended in OpenPGP Best Practices and many other sources. It consists in one offline master key plus a set of sub-keys for day-to-day operations stored inside an smart card.

My question is, what to do if my smart card gets compromised?

If I understand correctly, I must revoke all sub-keys using revkey command on the prompt of gpg --edit-key $KEYID. After that, I must create new sub-keys and export and share again my public key.

• Is this new public key my current public key? My new public key is twice bigger.
• How can I propagate sub-keys revocation to the OpenPGP network?
• What happens with people having my previous public key?
• What if I delkey sub-keys after revkey? My new public key changes but keeps a similar size.
• If I do the previous step, will sub-keys revocation propagate to the OpenPGP network?

Answer 1

After generating the revocations and new keys upload it to the sks network gpg --keyserver pool.sks-keyservers.net --send-key 0xDEADBEEF. Once that is done you can delete the old subkeys from your copies of your key if you want.

Nothing happens automatically but they will then be able to download an updated copy of your key from with revoked subkeys and new subkeys from the keyservers. You might want to set an expiry date on your key to force people to update your key on a regular basis. You can update the expiry date and reupload the key before it expires.

You can also e-mail people you know have a copy of your key suggesting they update it from the keyservers.

As long as you upload the revoked keys before deleting them they should propogate through the keyserver network