0

I've been using GPG key for a while to sign commits on GitHub. However, I recently lost it by accident when moving data around. It haven't leaked anywhere and signed commits can be trusted, I just don't have private key anymore.

So, should I delete public key from my GitHub account? This will remove "signed" mark from commits which seems to be wrong in my case when I just can't make any new commits with it.

1

I don't see any reason, why you would need to remove it. Losing the key changes nothing about its security. The key could have leaked, or could be broken later but that applies to a key you did not loose as well. You should rotate your keys in general.

In my opinion, it would be a better idea to keep it for as long, as you trust the key, so people can see you still trust the signatures. You can likely remove it, once the commits signed by it are no longer relevant.

A commit hash includes the hash of the previous commit, which means a single commit signed with the new key verifies all commits that came before it. Hence, the old key is only relevant, if some branches don't have a new commit or if the users work with old versions of the code.

0
  • If someone already had access to the key but didn't use it yet, they might still do so.
  • In case someone gets their hands on an old backup, they might be able to use the key.
  • There is no known vulnerability, but there might be in the future, giving an attacker access because you still have a key from 2019 added (who knows, in 2021 we might discover a debian PID-based key generation-like bug, or in 2029 an attacker might have a quantum computer, or...).
  • If you find your key again, you can always re-add it.

Why not remove it? It is good data hygiene to just clean up access keys that should never access a system anyway.

  • Hmm, than you. I think that would be a good idea to provide option like "archive" which will keep signed commits valid but will not trust new ones. Thing is that it's not about access but about trust to existing stuff. – val May 25 at 20:36
  • @val Oh, Github locks you into keep using the same key for forever? I didn't know that. That's bad on Github's part... :/ – Luc May 25 at 20:45
  • No, it does not. I already had uploaded new one. But I've already signed a lot of stuff using previous key and still pretty much trust it. – val May 25 at 20:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.