When viewing a key record in a public key server, such as this one, there are lots of keywords used: sig, sig3, exp3, Policy, sbind…). I understand that "sig" probably means a signature, but what's the difference between a "sig" and a "sig3" and a "sbind"? And what exactly is a "Policy" record?
What do the terms used in OpenPGP keyserver SKS mean? (sig, sbind, sig3, exp2, Policy, ...)
In OpenPGP, signatures are used not only for documents, but also for certifications between primary keys with different levels of trust (
sig3; as hex codes
0x13 in this order) and several more internal stuff.
Signatures are also very important for binding subkeys to primary keys (and the other way round): these are displayed as
sbind signatures by key servers, and a simple
sig by GnuPG, and have signature types
0x19 in OpenPGP. User IDs are bound by "normal" certification signatures, also called self-signatures or selfsigs.
If for any reason you want to undo a signature, this is generally not possible (you cannot delete anything from the key server network). Instead, you again issue another kind of signature, a revocation of a key (
0x20), revocation of a subkey (
0x28) or revocation of a certificate (
0x30). All of those will be displayed as
revok by most key servers, and
rev by GnuPG.
A certification policy displayed with the key word
Policy drops out of this list, a little bit, as it does not denote another signature type, but is a signature subpacket describing a so-called certification policy. I already left a more detailed description in "What are you saying when you sign a PGP key?". Notations also describe a certification, and could for example be used to describe how the signer identified the signee.
The signature types are defined in RFC 4880, OpenPGP, 5.2.1. Signature Types, signature subpackets only a little bit further down in the same document.
Jens, thanks a lot for the super detailed answer. I understand now that signatures (sig*) are used for issuing certificates. One thing I still don't get is, why would one issue a certificate (
0x30) in order to undo a signature? Aug 7, 2015 at 17:57
1Technically, all of those are signatures; I (and others) prefer using the term certification for signatures on keys. If you want to revoke a certification (thus, a signature on somebody else's key), you issue a new revocation (revocation signature), which tells "The previously issued certification is invalid". I think you misinterpreted my wording, which I slightly adjusted to hopefully remove ambiguity. Aug 8, 2015 at 9:24
There is a pretty good write up about PGP at Wikipedia.
According to the GPG manual (pgp for linux) under
The status of the verification is indicated by a flag directly following the "sig" tag...
So, looking at that:
Sig3means that another user has personally checked the fingerprint or key.
- If it says
Sigonly the means another user hasn't personally checked [the] fingerprint or key. (They're not vouched for.)
sbind is the time where the username was bound to the key. Basically when the record was created. This may be impacted by a policy.
revok is where the binding was revoked, so the key is no longer valid.
Policy is a specific user's policy in regard to how they'll exchange communications, their terms for contact, (and how they won't).
Also thanks for for answering :) I understand almost everything now. Aug 7, 2015 at 17:58