Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

How does one verify a key revocation?

After revoking a key and sending the revocation to MIT's keyserver, I noticed that the key is listed as such:

pub  2048R/XXXXXXXX 2011-01-01 *** KEY REVOKED *** [not verified]

Who is responsible for the 'verification of the revocation'? Does the owner of the key do this verification? If so, how is this accomplished? Do other people sign the revocation and at a certain point it becomes verified?

share|improve this question
2  
I don't get this note either, but I do notice that all of the revoked keys I've seen on MIT's keyserver have this. –  gertvdijk Apr 23 '13 at 0:10
add comment

1 Answer

No, the user of the key does. A revocation issued by the key itself, or by a designated revoker, which is some different key.

If I am going to encrypt to you, I look at the key before I do, and I look to see if your key is revoked. Similarly, if I am verifying a signature your key made, I look to see if the key is revoked.

share|improve this answer
2  
The key was revoked using the revocation cert and then sent to the keyserver. I am unsure which step of the process I am leaving out. –  earthmeLon Jun 20 '12 at 4:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.