0

I recently created a new gpg key just for the sake of learning the basics of public key encryption. Now, I'd like to revoke that test key so that I can go on using a more "permanent" key that is associated with my personal email account. Using the GPG Keychain application on Mac OS 10.15.*, I was able to revoke the key, and upload the revoke certificate to what they refer to as the "public key server".

However, when I attempt to search for my revoked key, I'm still able to find my public key indexed by my test email address. I've tested this on the OpenPGP Keyserver, the MIT PGP Key Server, and with the search function built into the GPG Keychain application. In the GPG Keychain, I am provided with this warning message when I try to search for the revoked key:

The following keys were found. Note that the search results come from the old sks key servers and are unverified:

My question is this, how long will it take for my revoke certificate to propagate to all the public key servers, so that my public key is no longer searchable in any way? Is it just a waiting game for the "old" key servers to synchronize with the "new" ones? Will I always be able to search out the public key by email? If so, what happens when the key reaches it's hard expiration date?

| improve this question | |
0

public key is no longer searchable in any way?

Won't happen. Your key will still be listed indefinitely, it will just be expired as of the date you revoked it.

waiting game for the "old" key servers to synchronize with the "new" ones?

I recently searched 6-8 keyservers and got 6-8 different lists of available keys including some old ones I had forgotten about.

In sum: GPG keys once uploaded persistent indefinitely, may or may not propagate to other keyservers, and are nearly impossible to remove. They can only be modified by revocation which really only sets them to expired.

| improve this answer | |
  • Thanks for the response. One follow-up question, if the key was given an "expiration date" when it was created (GPG Keychain defaults the expiration date to four years after the key creation), will the key still be searchable after that expiration date? Or is the "expiration" of a key fundamentally the same as the revoking a key? – Luke May 6 at 18:46
  • The key persists indefinitely - I saw keys expired years ago in my search. BTW you can have multiple keys with the same email address - the recipient must choose which one to use. – Peleion May 6 at 18:49
  • Doesn't the key have to persist indefinitely - otherwise anything encrypted with it will become inaccessible even to the creator/ signed with it will become uncheckable for corruption by others? (Open)PGP is also about trust - and a message where the key has expired is saying "be cautious" this may be out of date and no longer reliable whereas a revoked key is saying the originator thinks the key has been compromised and you should NOT rely on the information. – SlySven Jun 13 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.