1

There is a many-year-old 1024 DSA key in the public keyservers under my name. There is a 2048 ELG-E subkey for it. I didn't create these keys, they were created for me by a former employer without my consent. I don't have the private key and it apparently has no expiry date. (Just brilliant.) I know there is no way to remove them from the servers, but is there perhaps a way to crack them and issue revocation certificates? Is the cipher sufficiently aged/small to reasonably be able to crack them these days?

  • 1
    The former employer created the keys without your consent? You're truly suffering from a traumatic experience, I think $10 billion USD are just the beginnig helping to overcome this. I want 10% for this advice. – ott-- May 30 '15 at 21:33
1

If you didn't create the keypair and never had the private key, then it's not your key; it's a fake that was created by a third party. Anyone can create an OpenPGP key under anyone's name without their consent and upload it to the public keyservers. The fact that this was done by your former employer is irrelevant (unless it means you can contact them and ask them nicely to revoke the key).

The real solution to this problem is the web of trust: your genuine key should be verified directly by your contacts and/or signed by others that they trust (and whose keys they have verified). If your contacts don't understand this, your private communications with them are already doomed, as they will be easily fooled when a malicious man-in-the-middle provides them with a fake key.

0

The only exploit I can find on 1024 DSA is a traffic sniffing attack via a flawed pRNG, and it's a little unreasonable.

(If you can crack PGP, let the rest of us know so we can run around with our hair on fire :P)

Here's some ways to mark this key as invalid. However, unless you can get your hands on a revocation certificate, those keys are cast into the void.

http://www.pgp.net/pgpnet/pgp-faq/pgp-faq-key-revocation.html#revocation-without-secret-key

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.