Revoking a certificate (--edit-key + revsig)
Daniel Kahn Gillmor
dkg at fifthhorseman.net
Wed Jun 21 20:03:00 CEST 2017
On Fri 2017-06-16 10:06:38 +0300, Teemu Likonen wrote:
> My question is simple (kind of): In what situations would you revoke a
> certificate that you have made on someone else's key? (Technically:
> --edit-key + revsig.)
That action would be me saying "i no longer believe that this key is
only controlled by the entity that corresponds to the identity in the
in the abstract:
* i learned via some channel i consider trustworthy that this key isn't
appropriate for use with this User ID any more.
* "I had lunch with Sarah and she told me she'd lost access to her
secret key and didn't have a revocation certificate available."
* "Acme Corp. just published a press release on their https website
indicating that there was a break-in on their server "astrid". I
happen to know that the user account "archivemaster" on "astrid" has
a copy of their software-signing secret keys, but they haven't
revoked them publicly. I no longer have confidence that this key is
controlled solely by Acme Corp, so i'm removing my public attestation
Does this make sense? From the point of view of the person evaluating
the third-party signature, they can't tell the difference. they just
know that before they saw the revocation, they know that "dkg says this
key belongs to Sarah" or "dkg says that this is Acme Corp's
software-signing key", and after they see the revocation, they know "dkg
doesn't have anything useful to say about the identities on this key --
they could belong to anyone".
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 832 bytes
Desc: not available
More information about the Gnupg-users