8

I created a private key with an Android app I'm no longer using. I had uploaded the public key to the keyservers without setting an expiry date. I later deinstalled that app, and deinstalling apparently deleted the private key, or else I can't find it on my phone.

From time to time, people try to send me an email encrypted in that old key, because they don't know that I don't have access to the private key. Is there any way of revoking the key on the keyserver or adding a comment to prevent people from doing this? (I didn't create a revocation certificate.)

migrated from crypto.stackexchange.com Jul 9 '15 at 10:12

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • 3
    I pretty much answered this question on Ask Ubuntu already: "Lost PGP private key and want to remove it from keyserver.ubuntu.com". – Jens Erat Jul 9 '15 at 10:06
  • 3
    @JensErat, and the short version of your answer is basically "There is no sensible way to do this." Fair enough. – Turion Jul 9 '15 at 10:09
  • This question seems to have a correct and full answer. If you agree, mark it :). – dan Aug 10 '15 at 14:05
  • @daniel, I think Jens' answer on Ask Ubuntu is more exhaustive. And neither answer actually solves the problem, they just explain that there is no solution. – Turion Aug 10 '15 at 15:58
  • I fully agree. And sometimes the correct answer is the reference to a better one, and the truth that there is no solution. – dan Aug 10 '15 at 16:51
1

You normally would revoke the key:

Revocation is described in the link to another question on ask Ubuntu.

Basically:

The "OpenPGP way" to remove old keys is to mark them as revoked by uploading special revocation certificates. These will tell other OpenPGP users that your key is superseded.

Revoking keys is not possible if you don't have access to the private key, defined a designated revoker or a pregenerated revocation certificate.

Unfortunately, as you don't have access to the private key you wont be able to. Instead, you'll want to generate a new one and, if possible, let your contacts know via some other medium that your key has changed and they will need to use the new one. Often people post keys on twitter or to some other location only they control. If possible change your keys there to a new key and this time be sure to setup a revocation cert.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.