pgp public key failed to propogate

Question

I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key servers a while ago and uploaded a public key with:

gpg --send-keys --keyserver keyserver.ubuntu.com C3582062D32255323DEABDEEFAA3632602ACD45

...which worked in that the key made its way onto that keyserver, and on the web page of http://keyserver.ubuntu.com/ if I search for a substring of the email address associated with that ID, it finds it. (keyID above is not the real one)

According to this answer, the main keyservers are :

http://keyserver.ubuntu.com/

http://pgp.mit.edu/

https://keyserver.pgp.com

..but I definitely could not find my key anywhere on the other two main servers even months after the upload push from the terminal.

Does anyone know if these keys are really supposed to propogate by themselves between the servers within a few hours or not? If so, what have I done wrong?

Otherwise, what is a list of all the keyservers where the key should be deposited such that all mail programs can retrieve them? Is it just those three?

Answer 1

You need to upload your key to the servers that you want them on, they are owned by different entities and do not synchronise their record. You are looking for the servers in SKS pool (that propagate their data across different servers that GNU GPG tries to read as default). I would upload the key to keys.gnupg.net fo the best visibility.

Answer 2

My further experimentation lead to the following learnings which more or less answer this question.

In summary:

• At one point in time, one group of pgp keyservers might be in a pool, or in the habit of syncing with each other, but this changes from one year to another, or at least every few years.
• At any one time, there will be probably many, not just a few 'lone' keyservers out there which don't sync with any other servers, so a key will not propogate from them
• http://keyserver.ubuntu.com/ is a 'lone' server. Ubuntu is probably the leading company which has packaged linux for the consumer market. One might then assume that they would work to be a shining example of best practices in various open source and linux areas but looks like they have dropped the ball with the keyserver.

Some more detail of the experiments: The following is currently (Oct 2020) maintained list of keyserver pools:

https://sks-keyservers.net/overview-of-pools.php

and their statuses, and a list of 'lone' keyservers:

https://sks-keyservers.net/status/

The site is maintained by Kristian Fiskerstrand. Now there are 18 keyservers listed as being in the pool.

I uploaded a key to one server in the pool and noticed not long after the key had made its way onto other server in the pool.

There is another site from David Ross which lists the status from 2016:

https://www.rossde.com/PGP/pgp_keyserv.html

If you compare the lists you will see that 'lone' and 'pooled' keyservers has changed over the four years.

Answer 3

The 2019 certificate spamming attack showcased a design flaw in SKS Keyserver software that could not be easily fixed. Many decided to stop running it, for example, pgp.mozilla.org. Other SKS servers eventually stopped exchanging keys, like pgp.mit.edu which now lacks "gossip" peers in its stats page. Some never exchanged keys at all, like the PGP Global Directory on keyserver.pgp.com.

Various outdated or institution-specific online tutorials confuse with keyserver addresses that do not work anymore or do not work as expected.

pool.sks-keyservers.net, which used to direct to a random server in the SKS pool, went offline due to GDPR takedown requests. The address keys.gnupg.net was an alias for the pool.

After the 2019 attack, keys.gnupg.org, which is based on the hagrid server, became the default for new GnuPG installations. It does not peer. One reason is that it enforces a content policy, including a requirement for confirmation via email. This is still the default in GNOME Passwords and Secrets (Seahorse) along with a defunct server.

The default GnuPG keyserver changed later to keyserver.ubuntu.com, which runs a Hockeypuck key server. Hockeypuck servers can propagate the keys the same way as SKS servers over the OpenPGP HTTP Keyserver Protocol (HKP) which is the de-facto standard. keyserver.ubuntu.com directs users to a network on their "About this Server" page. That network does not have a catch-all address, so the user is expected to choose a peer. keyserver.ubuntu.com "has a good reputation for reliability, but it is not the only such choice". They also process GDPR requests. If it falls out of sync in any way, you might want to look at the list of currently active peers, which is maintained at spider.pgpkeys.eu, and upload your key to one of them.

To summarize on the above, keyserver.ubuntu.com is currently the default place to send your keys to and to look for keys. With gpg, you probably do not need to specify the keyserver for that. However, you still need to consider accordingly what server the person you communicate with might be using.