3

What's the best practice for eliminating keys you don't want?

So I figured out that I have an extra set of keys. What I want to know is if I should expire the ones I don't want or revoke them or something else? I've used them to sign emails but I don't think I've ever encrypted anything with them. I've already set an expiry date of tomorrow but should I bother keeping them or just revoke and then delete? I've already securely copied the correct keys from another machine. The expired keys were uploaded to the key server but IDK if that means the old ones were overwritten or if now there are two sets of keys up on the key server, one with an expiry set and one without?

1
  • Does stack exchange have a means for moving this conversation to Unix & Linux, assuming there is such a stack site? I've actually never heard of it. New? Also there are Windows and Mac variants of gnupg so perhaps this belongs on SuperUser? – user447607 Mar 12 '15 at 16:13
5

If the keys are stored on key servers, deleting is not an option. It is not possible to delete anything from the key server network.

So, you are to consider between expiration and revocation. Expiration has the meaning of limiting the validity to a given date, while revocation is a statement "I won't use this key any more", with the possibility of giving a reason (superseded, compromised, ...). I would say, revoking a key with message "superseded" is a clearer statement than setting an expiration date.

For primary keys expiration is not an option anyway: an attacker getting hold of the private key (eg., because it is easier to crack it in future) could simply change the expiration date, and use the key again. This is not possible, if you shared a revocation certificate. Also see Does GPG key expiration add to security?, but be aware one of the answers given is simply wrong.

3
  • Of course, that would only be the public key that is on a key server. Not much use if I discombobulate the private key in some manner. It definitely makes sense that if I can change the expiration date so can others. – user447607 Mar 10 '15 at 14:06
  • Question: What will happen to archived and signed emails if the key is revoked? Will they remain verifiable? Not that I think anyone cares but me. I sure wish they did. – user447607 Mar 12 '15 at 16:09
  • Yes, they do, at least using gpg on the command line -- it is hard to make an assumption for all available front ends / mail clients. A warning message might be displayed, though; especially if the encryption date was after the revocation date. Also signatures should stay valid if issued before the revocation. – Jens Erat Mar 12 '15 at 16:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.