A problem in the web of trust model or a gnupg bug?

Werner Koch wk at gnupg.org
Thu Feb 25 08:24:40 CET 2016

On Thu, 25 Feb 2016 00:45, dkg at fifthhorseman.net said:

> according to https://tools.ietf.org/html/rfc4880#section- :
>    If a key has been revoked because of a compromise, all signatures
>    created by that key are suspect.  However, if it was merely
>    superseded or retired, old signatures are still valid.  If the

If the key has been compromised and the attacker assumes that the
legitimate owner of the key is aware of that, the attacker may issue a
revocation certificate with "superceded" reason and and claim that a
later arriving "compromised" revocation has been done accidentally.
Thus I am not convinced that the revocation reasons are useful for any
automated evaluation.



Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

More information about the Gnupg-users mailing list