Kleopatra/ GPG can create revocation certificates, which look a lot like public/private keys. Obviously, these keys should not be shared or used unless one intends to revoke their keys. But assume that the revocation certificate were not secure. Would sharing this key with the world leak information about the private key which could be used to crack it? (obviously the denial-of-service/loss of trust would be a larger issue, but that's not the point of this question)


No. It does not reveal any information, except the key id, which is revealed to anyone who has a copy of either a signature made by the key, a message encrypted to the key, or the public key.

PGP keys are commonly distributed as base64 encoded data, which is simply a way of encoding data, not specific to PGP, and is probably what you say when you say it looks a lot like private keys.

The internal data is not similar. The revocation certificate is a signature, made with the private key, and a specific content, which basically says that it's revoked. You can examine the content of it easily:

gpg --list-packets revocation.asc
# off=0 ctb=88 tag=2 hlen=2 plen=120
:signature packet: algo 17, keyid <keyid>
        version 4, created 1586130213, md5len 0, sigclass 0x20
        digest algo 8, begin of digest d5 a4
        hashed subpkt 33 len 21 (issuer fpr v4 <issuer>)
        hashed subpkt 2 len 4 (sig created 2020-04-05)
        hashed subpkt 29 len 1 (revocation reason 0x00 ())
        subpkt 16 len 8 (issuer key ID <keyid>)
        data: [256 bits]
        data: [254 bits]

As you can see, it has a signature type 0x20. If we go to RFC4880, which standardizes PGP, we can read the following about signature type 0x20:

0x20: Key revocation signature

The signature is calculated directly on the key being revoked. A revoked key is not to be used. Only revocation signatures by the key being revoked, or by an authorized revocation key, should be considered valid revocation signatures.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.