Using the "preferred keyserver URL" in GnuPG 1.4

Simon Josefsson jas at
Wed Dec 22 02:22:21 CET 2004

David Shaw <dshaw at> writes:

> I'll make you a deal - if you write the DNS handler to properly handle
> a flag passed from gpg to do a revocation-only search, I'll write the
> code in gpg to pass that flag when appropriate.  Since a
> revocation-only check can also be fulfilled (though slower) by a
> regular check, this would be nicely backwards compatible.

I tried my Perl version, and it still worked.  Is Perl acceptable, or
do I have to rewrite it in C?

Get, and install it in
the keyserver directory, add

keyserver jkp://

The server knows the 57548DCD and b565716f keys only:

jas at latte:~$ gpg gnupg-1.4.0.tar.bz2.sig
gpg: WARNING: using insecure memory!
gpg: please see for more information
gpg: Signature made Thu 16 Dec 2004 11:50:52 AM CET using DSA key ID 57548DCD
gpg: requesting key 57548DCD from jkp server
gpgkeys: attempting key 0x68B7AB8957548DCD from jkp://
gpgkeys: querying for (, CERT)
gpgkeys: key 0x57548DCD retrieved from
gpg: key 57548DCD: public key "Werner Koch (gnupg sig) <dd9jn at>" importedgpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model
gpg: depth: 0  valid:   3  signed:   3  trust: 0-, 0q, 0n, 0m, 0f, 3u
gpg: depth: 1  valid:   3  signed:   5  trust: 2-, 0q, 0n, 1m, 0f, 0u
gpg: next trustdb check due at 2005-04-13
gpg: Total number processed: 1
gpg:               imported: 1
gpg: Good signature from "Werner Koch (gnupg sig) <dd9jn at>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 6BD9 050F D8FC 941B 4341  2DCC 68B7 AB89 5754 8DCD
jas at latte:~$

How will you design the protocol for revocation checks only?

When is it appropriate to do the revocation check?  It sounds as if
this should be configurable?  Maybe add a parameter:

revocationserver jkp://

or something?

Or would revocation only be done through the "preferred key server"
field from the owner's key?

Perhaps revocation checks shouldn't be done too often?  Might be some
work in remembering when the last check was done, though...


PS.  I'll take care of the paper work as well, of course.

More information about the Gnupg-users mailing list