6

i'm getting re-acquainted with OpenPGP and noticed that GnuPG allows me to store a "preferred keyserver" URL in my keys:

reuben@localhost:~$ gpg2 --edit-key 'Reuben NP Garrett <my-special-email@example.com>'
gpg> help
..
keyserver   set the preferred keyserver URL for the selected user IDs

this seems to influence GPG's 'refresh-keys' operation, since when i tried setting this value to http://pgp.mit.edu/ (where i'd previously published my keys), GPG complained of "no key data found for http://pgp.mit.edu/". however, when the keyserver URL was set to an unreachable value (https://pgp.mit.edu/), GPG instead complained that it "couldn't connect to host" and failed over to keys.gnupg.net (as a built-in server, i suspect).

is the "preferred keyserver" URL supposed to directly target my key, e.g. http://pgp.mit.edu/pks/lookup?op=vindex&search=0x0B17E17AADF01139? or what is a "correct" (or useful/meaningful) way to set this property?

8

The Option

This option allows you to setup the preferred key server others should (but not must) use when refreshing your key. This could be your own, or the one your institution provides. A preferred key server can reduce the synchronization latency between OpenPGP participants.

Key Exchange Protocols

You must not enter the http URL of the key server. GnuPG uses another protocol for key exchange, namely hkp. For pgp.mit.edu use hkp://pgp.mit.edu.

There is a post on security.pgp-basics describing all the available protocols:

  • ldap (might be important in some enterprise scenarios)
  • hkp (the de-facto standard for all key server operations ourdays)
  • http
  • finger
  • mailto (had broad usage in earlier days, especially for exchanging information between key servers)

SKS Key Server Pool

Even better, use the SKS key server pool MIT is participating in: hkp://pool.sks-keyservers.net. Most key servers (but http://wwwkeys.pgp.net) are well-connected among each other and synchronize very fast, so selecting a distinct key server isn't very important. Using the SKS key server pool is usually recommended, as it contains all the relevant key servers and increases availability over using a dedicated key server.

  • i discovered the hkp: scheme shortly after posting, and it worked as expected. also, thank you for the info on the SKS pool - will start using it! – RubyTuesdayDONO Jan 6 '14 at 10:47
  • Unfortunately, the link to the post is no longer working. It would be great, if you could summarize the available protocols. – not2savvy May 28 '18 at 18:16
  • I found the post on archive.org, added some words anyway. – Jens Erat May 28 '18 at 19:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.