7

I have some public keys of multiple users in my keyring in GnuPG. One of these users has switched to a new public key. I still have the user's old key which has an assigned trust of ultimate. I just assigned the same trust to his new key.

He does not use the old key anymore. What should I do with the old key? Should I withdraw trust, or revoke it? What is the correct procedure in such a case?

Jens Erat
  • 2,233
  • 2
  • 21
  • 33
lord.garbage
  • 2,323
  • 5
  • 27
  • 41
  • Would it be worth migrating this question to [Information Security SE](http://security.stackexchange.com/)? Although on-topic here, it is just as on-topic on (and helpful for) any operating system that uses PGP. – IQAndreas Oct 08 '14 at 16:28
  • @IQAndreas If it was not well received on here, then the OP can request migration, as long as the question isn't crap. If he already has answers, and it's still on topic here, then the SE policy is to play it as it lies... Kinda like Golf... – Canadian Luke Oct 08 '14 at 22:20

2 Answers2

7

First of all, ultimate trust shouldn't be used for other's keys, full trust is enough. If you issued ultimate trust to make the key itself valid, you missunderstood the web of trust concept. If you just wanted all his certifications to be valid for you (thus, extending your web of trust), full trust is enough, if you at the same time certified him.

Regarding your actual question: this depends a little bit on the situation.

  • You will not be able to revoke the other's key. Has the key's owner revoked it? If so, he should just send you the revocation certificate -- for example by uploading it to the key servers, where you can fetch it again. If the key is revoked, you do not have to care about trust any more anyway.
  • The key owner has lost control over the key, but cannot revoke it any more. For example, somebody stole the laptop with the only copy of the key, and the owner doesn't have a revocation certificate (very bad idea). Now it's at you to fix the situation, by withdrawing trust and setting it to "never". Also consider doing the same with his new key, as there seem to be major issues with the owner's key handling. This does not change validity if his key (if you signed it), it just makes sure certifications issued by it won't be used for validity calculation of others.

  • The key owner just doesn't want to use the key any more, but still owns it and wants to keep the reputation in the web of trust he build up (which you probably also want to make use of): Just import his new key, and don't care about the old one at all. Apart from changing trust from "ultimate" to "full".

    If you want to make sure you're not accidentially encrypting to his old key, disable it by running gpg --edit-key [key-id], then using GnuPG's disable command.

Community
  • 1
Jens Erat
  • 2,233
  • 2
  • 21
  • 33
1

You cannot revoke the old key. Only the owner (whoever holds the private key) can do that.

You probably don't want to remove the key from your keyring altogether because you still want to be able to verify signatures on old emails that were signed by your correspondent using the old key. Changing the trust level also seems to me like the wrong solution because it implicitly means that those signatures on old emails are not as trusted as they once were, which is not really right.

How about disabling the old key?

A disabled key can not normally be used for encryption.

So your software (or yourself) won't accidentally use the old key to encrypt messages. The key remains in your keyring, otherwise unchanged.

Celada
  • 43,173
  • 5
  • 96
  • 105