7

I've been foolish over the years and created a few OpenPGP keys for various reasons (mostly self teaching) and never revoked any of them or changed them etc before re-installs or whatnot.

Anyhow I was wondering if there was a way to fix my mistakes, I have a list of all the previous keys I've used on Ubuntu's keyserver and was wondering if there was a way to re-import and revoke them or are they a lost cause.

I've since learned my errors and abide by a strict backup/revoke policy now.

1
  • You might be interested on having a subkey besides your private key. The advantage of using a subkey is that you can carry it with you and eventually have it stolen (if your laptop is stolen) without too much hassle. All you need is keeping your private key safe (as it should always be). More details here: nxfifteen.me.uk/pgp/creation Oct 26, 2017 at 1:17

1 Answer 1

8

It depends on whether you still have the private key, or not.

  • Having access to the private key:

    You're lucky, and will be able to revoke the key. It is as easy as running gpg --edit-key [key-id]. Inside the edit menu, run revkey. Import the revocation certificate if needed (gpg --import [file]), and send it to the key servers (gpg --send-keys [key-id]).

  • Having no access to the private key:

    This is very bad, as you're now not the key owner any more, but an "evil attacker".

    Short answer: You're out of luck an will not be able to remove the keys, they will stay forever.

    Long answer, with some perspective:

    • In future times, it might be possible to brute-force old RSA 1024 keys within a reasonable amount of computing time. But don't expect this happen soon. Quantum computers might change this situation, once they actually arrive.
    • There is another thing you can do to at least hint that you're not using these keys any more: OpenPGP knows so-called designated revocations, where a key may be revoked by another one. You could use your newest key to generate such revocations, but be aware these will not really be valid (as the old keys very likely did not specify your new one as designated revoker). But other users might observe this and draw their own conclusions. In the end, it's the best thing you can do.

Anyway: you're nor alone, this happens to a lot of people. If the keys do not have any certifications, it's pretty safe to ignore them anyway, as anybody could have created fake keys for your name (and even key ID).

GnuPG 2.1 automatically generates revocation certificates together with new keys. Make sure to generate one manually if using an older version, and also make sure to have a save backup of this certificate: I recommend creating a QR code (qrencode is helpful here) and print it on a piece of paper you could also hand over to a trusted person (the only thing that could happen is this person maliciously revokes your key, but cannot gain further access).

3
  • Alright, that's pretty much what I was expecting. No I don't have the private keys as most of them were generated from Ubuntu Karmic or abouts until now. If they are going to stay then I can't do anything about it, is there any security or any other reason why I should be worried then about the keys that are floating around the keyservers?
    – kenny727
    Mar 17, 2015 at 20:03
  • People might be using the wrong keys, and it just "looks weird and somewhat unprofessional" having a bunch of abandoned keys floating around. No real security issues. Remember, everyone could have created those.
    – Jens Erat
    Mar 17, 2015 at 20:48
  • I understand that, fortunately none of the key's I used previously ever went any further then the keyservers and maybe for my github account which was inactive then. They were never used for anything and were never given publicly other then the server. Anyhow I'll mark your answer as accepted, I appreciate the help.
    – kenny727
    Mar 18, 2015 at 11:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .