Certs by a revoked key

[David Shaw]

On Mon, Feb 24, 2003 at 01:56:17PM -0600, Richard Laager wrote:

> > There is when there is no reliable way to tell the difference
> > between "retired" and "compromised", or more specifically
> > "compromised after retirement".
> 
> I take it this is because multiple revocation certs are not
> supported. Is this the case? Or, is this based on an assumption that
> after a key is retired, it could be compromised and the legitimate
> owner wouldn't notice?

No, multiple revocation certs are supported (section 10.1 of the spec:
"Zero or more revocation signatures").  While it is true that a
retired key could be compromised, that's not really my point either.

Let's make sure we're talking about the same thing.  What exactly are
you suggesting here?  It sounds like you are saying that the 0x01 and
0x03 revocation reasons are a "revocation lite" that means "don't use
this key anymore, but don't really fully revoke it in terms of the web
of trust either".

David

-- 
   David Shaw  |  dshaw@jabberwocky.com  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson