23

I have create GPG Keys for code signing and created a revocation certificate also. As far as I know, if key is compromised then i can revoke the key using revocation certificate.

Can someone suggest me how to revoke my key with revocation certificate? Also one more doubt is, after revoking keys should I upload at any GPG Key server? So that someone using my keys to verify code signing can check whether Key is revoked or not before using my code signed files.

if uploading in key server is not required then how my customer can check key is revoked or not?

2 Answers 2

31

This a summary of the steps for revoking, based on the article GPG: Revoking your public key and notifiying key-server. The following assumes that the key server is pgp.mit.edu.

List keys

gpg --list-keys

Revoke your key

gpg --output revoke.asc --gen-revoke key-ID

Import revocation certificate into your keyring

gpg --import revoke.asc

Search your key on the key-server

gpg --keyserver pgp.mit.edu --search-keys key-ID

Send the revoked key to the key-server

gpg --keyserver pgp.mit.edu --send-keys key-ID
5
  • if I executegpg --import revoke.asc, means i imported my revocation certificate to key ring. But how to revoke my key with this certificate?
    – Karma Yogi
    Feb 18, 2020 at 9:22
  • Also after sending, my revoked key to key server, if i execute gpg --keyserver pgp.mit.edu --search-keys key-ID i do not see any information as this key is revoked
    – Karma Yogi
    Feb 18, 2020 at 9:31
  • Revocation only adds the revocation information to the key. In case of problem, please add the output of search-keys to your post, or even better, the whole session of revocation on local and server.
    – harrymc
    Feb 18, 2020 at 11:37
  • The "Revoke your key" step, is that actually revoking your key, of is it just generating the certificate? May 24, 2022 at 9:02
  • @KarlMorrison: As in my previous comment, it marks the key as revoked.
    – harrymc
    May 24, 2022 at 9:20
9

As far as I know, if key is compromised then i can revoke the key using revocation certificate.

Yes, but as long as you have the actual private key (f it's compromised but not destroyed), you can always use it to revoke itself. That is, it can always generate new revocation certificates "on the fly".

Instead, the pre-generated revocation certificate exists for situations when the private key is completely lost, not merely when it's compromised. It's something to store on a USB stick at a friend's house.

(Of course, you should always keep a backup of the private key off-site as well. But the big difference is that a backup of the private key is much more sensitive, since if stolen it can be used to do anything under your name, whereas the 'revocation certificate' can only be used to do one very specific thing.)

Can someone suggest me how to revoke my key with revocation certificate?

It should be enough to import the revcert into your PGP keyring – it is essentially just a key signature ("self-certification" in GnuPG) that attaches to your main public key in the exact same way as you can have other people sign your key and import those signatures.

As soon as it is imported, the program should show the key as revoked and you should publish the updated public key in standard locations (keyserver, etc.)

Also one more doubt is, after revoking keys should I upload at any GPG Key server?

Yes, you should. Publishing keys (and updates to keys) is what keyservers are for.

if uploading in key server is not required then how my customer can check key is revoked or not?

You can manually (re-)export the revoked key to a file and give it to them directly (or publish it on Keybase or your website – if you expect the customer to re-check it daily...) But they're certainly not going to magically know what happens inside your computer. That's why keyservers exist.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .