0

I have been using pgp for years now, but usually email the person my public key and compare its fingerprint over the phone or give it to them in person on a stick. I thought I might try out the key servers a while ago and uploaded a public key with:

gpg --send-keys --keyserver keyserver.ubuntu.com C3582062D32255323DEABDEEFAA3632602ACD45

...which worked in that the key made its way onto that keyserver, and on the web page of http://keyserver.ubuntu.com/ if I search for a substring of the email address associated with that ID, it finds it. (keyID above is not the real one)

According to this answer, the main keyservers are :

http://keyserver.ubuntu.com/

http://pgp.mit.edu/

https://keyserver.pgp.com

..but I definitely could not find my key anywhere on the other two main servers even months after the upload push from the terminal.

Does anyone know if these keys are really supposed to propogate by themselves between the servers within a few hours or not? If so, what have I done wrong?

Otherwise, what is a list of all the keyservers where the key should be deposited such that all mail programs can retrieve them? Is it just those three?

0

2 Answers 2

1

You need to upload your key to the servers that you want them on, they are owned by different entities and do not synchronise their record. You are looking for the servers in SKS pool (that propagate their data across different servers that GNU GPG tries to read as default). I would upload the key to keys.gnupg.net fo the best visibility.

0

My further experimentation lead to the following learnings which more or less answer this question.

In summary:

  • At one point in time, one group of pgp keyservers might be in a pool, or in the habit of syncing with each other, but this changes from one year to another, or at least every few years.
  • At any one time, there will be probably many, not just a few 'lone' keyservers out there which don't sync with any other servers, so a key will not propogate from them
  • http://keyserver.ubuntu.com/ is a 'lone' server. Ubuntu is probably the leading company which has packaged linux for the consumer market. One might then assume that they would work to be a shining example of best practices in various open source and linux areas but looks like they have dropped the ball with the keyserver.

Some more detail of the experiments: The following is currently (Oct 2020) maintained list of keyserver pools:

https://sks-keyservers.net/overview-of-pools.php

and their statuses, and a list of 'lone' keyservers:

https://sks-keyservers.net/status/

The site is maintained by Kristian Fiskerstrand. Now there are 18 keyservers listed as being in the pool.

I uploaded a key to one server in the pool and noticed not long after the key had made its way onto other server in the pool.

There is another site from David Ross which lists the status from 2016:

https://www.rossde.com/PGP/pgp_keyserv.html

If you compare the lists you will see that 'lone' and 'pooled' keyservers has changed over the four years.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.