1

I want to revoke my PGP public key using Bouncy Castle API. I have generated a revocation certificate. But I wasn't able to find a way to revoke a public key using a revocation certificate. How would I achieve it?

I found the method addCertification in PGPPublickey.java class but it is for adding a certificate and not for adding a revocation certificate.

I tried this method but it actually adds any revocation certificate to a public key, and the key is being revoked too. However, the public key should add only that revocation certificate that is generated from the corresponding private key.

Abraham Philip
  • 648
  • 9
  • 18
Sohan Badaya
  • 365
  • 4
  • 15
  • This is a common misconception among beginners to PGP, one I had harboured myself - that adding a revocation certificate to a key is different from adding any other certificate. Hence, the upvote. – Abraham Philip Mar 21 '15 at 15:35

2 Answers2

1

You should add revocation certificate to your corresponding public key, and send this updated key to keyservers or other parties you are communicating to.

Nickolay Olshevsky
  • 13,706
  • 1
  • 34
  • 48
  • I think you got wrong my question. I am struggling with revoking public key. My public key is getting revoked by any revocation certificated. But actually public key should revoke by only revocation certificate that is generated from corresponding private key. – Sohan Badaya Dec 27 '12 at 05:11
  • 3
    Sure, you can add any certificate to your public key. That's receivers work to check this certificate and decide whether to trust it or not. – Nickolay Olshevsky Dec 27 '12 at 09:38
1

You're right on one count and wrong on another.

The Right: You've found the correct function for adding a revocation certificate to key. The addCertification function is what you should use to add your revocation certificate to a PGP Key.

The Wrong: That the function should not let you add a revocation certificate signed by someone other than the owner of the public key (which I have surmised is your assumption).

You can add any certificate signed by anyone to a PGP key. Whether the attached certificate has a relevant effect on the key is another matter.

For example, I could attach a revocation certificate generated by my secret key to your public key. However, does this mean your key has now been revoked? In short, no, it doesn't. This is because a public key can be revoked only by a revocation certificate signed by the corresponding private key, and it is up to the respective implementation (say, an encryption program like GPG) to verify this before saying your key is revoked.

In your case, your public key could have any number of revocation certificates attached to it. However, only a revocation certificate signed by the corresponding private key (which you presumably own, and is hopefully secret) will have the effect of actually revoking it.

That said, if you wish the fact that you have revoked your key to be communicated to the rest of the world, that is, via keyservers, you should first generate a revocation certificate signed by your private key, attach it to your public key (effectively revoking it), and then upload this revoked key to a keyserver. The keyserver will simply merge your key to the copy they have (if they have it), and propogate this key to other keyservers it knows. If all goes well, in a few days or longer, your revoked key should be available across the keyservers connected directly or indirectly to the keyserver you uploaded your key to.

Abraham Philip
  • 648
  • 9
  • 18