default keyserver-options [was: Re: keys not available for signed messages in this maillist]

[Daniel Kahn Gillmor]

On 04/09/2011 10:48 AM, David Shaw wrote:
> I agree that include-subkeys should be on by default.  That only makes sense, especially now that subkeys are frequently used for signing.

yep.

> I'm not so sure about include-revoked, though.  
 [...]
> remember that anyone can fake a revocation for any one else's key on a keyserver

I think this last point is the main reason *for* setting include-revoked
to "on" by default.

Otherwise, if the keyservers supported the include-revoked=off option,
Bob could prevent anyone from finding Alice's actual key unless they
knew the configuration option.

 Alice has key 0xDECAFBAD.  she uploads it to the keyservers.

 Bob creates a key, puts Alice's name on it, and uploads it to the
keyservers.

 Bob uploads a faked (invalid) revocation certificate for 0xDECAFBAD.

 Charlie searches for a key with Alice's name on it, and finds exactly
one: But it's Bob's key!

This seems like a bad arrangement.  defaulting include-revoked to "on"
would make it so Charlie can see both keys.

	--dkg

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 1030 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20110411/f7762657/attachment.pgp>