Options to revoke a key

[Atom 'Smasher']

> > I still remember fragments of my passphrase. That's why I'am asking
> > for advice how to brute force recover it.
>
> Infeasibility of brute-force compromise is a goal behind the algorithms
> used to protect the key.  If it were feasible to do so, we'd want to
> know about it so that it could be fixed (made infeasible) again.
>
> As far as the software is concerned, someone who has lost their
> passphrase is indistinguishable from someone who never knew it.
====================================

although, if you remember pieces of it, then you do (in theory) have an
advantage over anyone else who might try to brute-force it.... with the
pieces that you know, and some programming, it still may not be feasible
to crack your own password.

something else of relevance, that i found in the man page, is:
		--desig-revoke
	Generate a designated revocation certificate for a key.  This
	allows  a  user  (with  the  permission  of the keyholder) to
	revoke someone else's key.
and...
		addrevoker
	Add a designated revoker.  This takes one  optional
	argument:  "sensitive".  If a designated revoker is
	marked as sensitive, it will  not  be  exported  by
	default (see export-options).

i haven't played with them, but they may be worth looking into if one has
a trusted friend/partner who is less likely than oneself to lose the keys.

idea... (sorry, i'm thinking out loud, again) what if bob generates a
revocation certificate, and uses gpg to encrypt a copy of it for alice
(using alice's public key), and then encrypts that copy for carol (using
carol's public key). then bob sends that double-encrypted copy to carol,
with instructions to both carol and alice... neither carol nor alice could
decrypt the certificate unless they both work together, which presumably
they'd do only at bob's request to recover the revocation certificate.

of course, if you have a place that's [electronically, physically and/or
socially] secure enough to store a revocation certificate, then you should
consider if it's also secure enough to store a copy of your pass-phrase.

conventional wisdom says you should never write down a password, but with
reasonable precautions it might be better to have a copy you can get to.
check out the password links (towards the bottom) that i've collected at -
http://smasher.suspicious.org/open/


also, an expiration date on keys let's them die on their own if they're
not maintained... i'm keeping my keys good for 12-24 months at a time...
when the expiration date hits 12 months, i'll add another 12 months to
them. i figure it's easier to update (or force people to update) a key
that expires at a later date, than an earlier date.


        ...atom

_______________________________________________
PGP key - http://smasher.suspicious.org/pgp.txt
3EBE 2810 30AE 601D 54B2 4A90 9C28 0BBF 3D7D 41E3
-------------------------------------------------

	"Fighting crime by building more jails is like
	 fighting cancer by building more cemeteries."
		-- Paul Kelly