A problem in the web of trust model or a gnupg bug?
wk at gnupg.org
Thu Feb 25 08:24:40 CET 2016
On Thu, 25 Feb 2016 00:45, dkg at fifthhorseman.net said:
> according to https://tools.ietf.org/html/rfc4880#section-220.127.116.11 :
> If a key has been revoked because of a compromise, all signatures
> created by that key are suspect. However, if it was merely
> superseded or retired, old signatures are still valid. If the
If the key has been compromised and the attacker assumes that the
legitimate owner of the key is aware of that, the attacker may issue a
revocation certificate with "superceded" reason and and claim that a
later arriving "compromised" revocation has been done accidentally.
Thus I am not convinced that the revocation reasons are useful for any
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.
More information about the Gnupg-users