Do I have to keep the revocation certificate of my OpenPGP key in a safe place or may I place it in e.g. Dropbox to have it ready on all my machines?

I know that, if compromised, the certificate can be used by anyone to revoke my key. I am just assuming my Dropbox/whatever place is reasonably secure from unallowed access.


Anybody with access to your revocation certificate is able to revoke your key, with you losing all reputation in the OpenPGP web of trust in consequence (but that's it, he will not gain access to your private key).

You can put it anywhere you like – it might just not be reasonable. How bad this would be and how much the gain of a less secure storage would be is your decision. Anyway: be aware you will (hopefully) never need it. Though, if you have to expect your key to be stolen at any time with a reasonably high chance, it might be a good idea to have the revocation certificate at hand all time. You will have to find the balance between availability and security, where exactly to go depends on your needs and must be your decision.

Cloud hosters should never be considered save nor trustworthy.

I'd recommend to additionally create a QR code with the certificate, print it a few times and store it in your bank safe or with somebody you trust, for example your parents. You can create such a QR code using gpg --armor --gen-revoke [Key-ID] | qrencode (probably you will add some options, but make sure to print it next to the code, just in case...).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy