23

Because of an accidental formatting I've lost two private keys(no backup). I've generated a new one but I want to remove the lost ones from the keyserver.

5
  • 2
    possible duplicate of How to revoke old OpenPGP keys?
    – Jens Erat
    May 19, 2015 at 22:14
  • 1
    This isn't about revoking and nothing to do about it! May 20, 2015 at 7:51
  • The problem is the exactly same. You won't be able to delete anything from the keyserver network.
    – Jens Erat
    May 20, 2015 at 8:27
  • 1
    It's about server's deletion not revoking. May 20, 2015 at 14:11
  • You're right, I misremembered the wording of the question (and didn't look it up properly, shame on me). I thought it would be more like this question on Super User. The result is indeed the same, though; deletion is not possible, and also no revocation without access to the private key.
    – Jens Erat
    May 21, 2015 at 12:57

4 Answers 4

19

TL;DR: There is no way, you're out of luck.

Deletion

OpenPGP key servers do not allow removal of keys for various reasons, mostly it boils down to

  • having the OpenPGP web of trust being resilient against deletion attacks,
  • missing procedures to do so,
  • technical reasons with the key servers exchanging keys with each other ("gossiping") and
  • the fact key servers are operated by hundreds of individuals all over the world (also in pretty much all countries of the world, if you'd like to go through the legal route).

If you'd ask the individual operators to remove a key, they might block it on their own server (but the others will still be hosting it), or simply tell you they won't do so because of the reasons given above.

For further reading, I'd recommend How long do keys stay on keyservers? for a more detailed discussion why deleting keys would be a bad thing to have.

Revocation

The "OpenPGP way" to remove old keys is to mark them as revoked by uploading special revocation certificates. These will tell other OpenPGP users that your key is superseded.

Revoking keys is not possible if you don't have access to the private key, defined a designated revoker or a pregenerated revocation certificate.

If you don't have a revocation certificate for your new key yet, generate one now!

Comments

Comments are hardly possible, either:

  • people would not realize they're there if using some OpenPGP client software
  • anybody could've uploaded them, as you can't sign them with your private key
  • there is no such thing as comments anyway.

Precautions

To prevent loosing access to your key, do following:

  1. Regularly backup your computer (important anyway).
  2. Create an offline copy of your private keys.
  3. Create a revocation certificate immediately after creating a primary key. Store it both in a digital way and print it on a piece of paper (I recommend something like gpg --gen-revoke | qrencode to be able to scan the certificate without the hassles of OCR).
  4. Create a second copy and hand it to somebody you trust. He cannot do anything but revoke your keys with it (never gain access!), but you always have a fall-back in worst case scenarios (house burned, robbery, ...).
2
  • 2
    How does this harmonize with GDPR? Aren't the server operators legally required to provide a deletion mechanism if they have European users?
    – nisc
    Aug 1, 2021 at 5:40
  • I would also like to know how this work with GDPR
    – lpuerto
    Apr 27, 2022 at 14:47
6

I am afraid that this is not possible. As pgp keys are synchronized also with other servers, it would also not be effective. Other keyservers would still have your key.

The following will not be very helpful for you, but it may help other readers:

If you had the private key, you could have used gpg to generate a revocation certificate, and upload that to the keyserver. This would not delete your key from the key server, but it would tell people who download it that the key has been revoked, and should not be used. More information on this can be found here.

3

For future readers of this question.

Of course you can delete keys from a keyserver since they aren't physically engraved onto a indestructable stone.

Jokes aside I also wanted to have a key removed from ubuntu keyservers and I submitted a data privacy enquiry on their website. https://ubuntu.com/legal/data-privacy/enquiry

I also signed this message with the key that I wanted to have removed. You probably can also provide a photo of an ID to have a key with your personal data removed.

A couple of days later I got an email from ubuntu that they received my request according to GDPR article xyz followed by another email a few hours later that they have removed my key.

0

Your private key is not on any keyserver unless you have done something Very Wrong. The only key that should be on the keyserver is your PUBLIC key.

So, you cannot retrieve your private key from a keyserver in any case.

If you have only "formatted" your disk (and not done security wipe or physical destruction), then you may be able to recover the private key using file recovery or forensic techniques. These methods will depend on the disk format, operating system and other factors.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .