Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Note: this is a purely hypothetical situation.

Suppose that I had created a PGP key, pushed it to the Ubuntu keyserver (hkp://keyserver.ubuntu.com), and added it to my Launchpad account. Further suppose that my PGP key was compromised somehow.

Apart from removing the key from Launchpad, what steps do I need to take?

share|improve this question

2 Answers 2

up vote 7 down vote accepted

gpg --list-keys
Find your key id:

pub   2048R/deadb33f 2012-03-10
uid                  Something <someone@example.com>


gpg --edit-key 0xdeadb33f

Command> revuid
Really revoke this user ID? (y/N) y
Please select the reason for the revocation:
  0 = No reason specified
  4 = User ID is no longer valid
  Q = Cancel
(Probably you want to select 4 here)
Your decision? 4
gpg --keyserver keyserver.ubuntu.com -send-keys 0xdeadb33f

From the gnupg mailing list:

    gpg --keyserver pool.sks-keyservers.net -refresh-keys 0xdecafbad

now use gpg to revoke the UID

    gpg --edit-key 0xdecafbad

gpg displays a list of UIDs on the key. Enter the number of the UID you
wish to revoke. The list is redisplayed with an * next to the selected
one. now use the gpg command revuid to revoke:

    Command> revuid
    Really revoke this user ID? (y/N) y
    Please select the reason for the revocation:
      0 = No reason specified
      4 = User ID is no longer valid
      Q = Cancel
    (Probably you want to select 4 here)
    Your decision? 4

Answer the passphrase prompt and 'save' to update your keyring with the
modified key. Now send the key with revoked UID to the keyservers

    gpg --keyserver pool.sks-keyservers.net -send-keys 0xdecafbad
share|improve this answer

You're asking about PGP, I would think that the same applies as what you would Do with Gnu Privacy Guard (GPG). During the creation of your Key, you would go one step further and create a revocation key. For details and steps please see the official documentation here.

share|improve this answer
    
What happens if I didn't create a revocation key? –  Nathan Osman May 25 '12 at 23:12
    
I believe that the revocation key will propagate and let others who have trusted your key know that it has either become compromised, or lost. It also allows for you to remove your key in the event you forget your passphrase. If you know your passphrase, you could do what aking1012 suggested as it will remove your key from the server. You should just try and let the others that have trusted your key in some fashion. –  itnet7 May 25 '12 at 23:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.