23
$\begingroup$

According to this Q&A-discussion it is possible to remove all personal data (name and mail address) that is attached to a public key.

  1. What steps do I have to follow in order to remove all personal data?
  2. Will that modified public key still allow me to decrypt data with my regular passphrase?
$\endgroup$

2 Answers 2

24
$\begingroup$

You cannot remove all UIDs, but you can create one which does not link to your identity and remove all others.

  1. Backup your .gnupg folder (for unix systems, for Windows wherever your key is stored)!

  2. Start editing your key:

    $ gpg --edit-key 47AB515A
    
  3. Create an anonymous UID:

    gpg> adduid
    Real name: Anonymous
    Email address:
    Comment:
    You selected this USER-ID:
        "Anonymous"
    
  4. Now we're ready to delete all others, but need to know which to remove:

    gpg> list
    
    pub  2048R/DEADBEEF  created: 2013-07-28  expires: never       usage: SC
                         trust: ultimate      validity: ultimate
    sub  2048R/DEADDA7A  created: 2013-07-28  expires: never       usage: E
    [ultimate] (1)  Foo Bar <[email protected]>
    [ unknown] (2). Anonymous
    

    Every UID has a number (in parentheses).

  5. Select all UIDs you want to remove (probably all but the newly created one):

    gpg> uid 1
    

    And repeat as needed. All selected UIDs will have a star in their record:

    [ultimate] (1)* Foo Bar <[email protected]>
    
  6. Delete all selected UIDs:

    gpg> deluid
    
  7. Save and exit:

    gpg> save
    

This removes all personal information from your key - including all signatures (each is bound to an UID), so your "stripped down" key will lose all trust.

You will be able to use it like before; usually every OpenPGP encryption container contains your key ID which does not change, neither does your pass phrase.

If you did not publish your key yet, nobody will be able to find out who you are based on your OpenPGP key. As the key ID stays the same, an already published key can be looked up on the keyservers, they will not delete your UIDs but combine all they ever saw. You can never remove a published key or parts of it from the keyservers.

Caveat: The sender now must select which key to encrypt to as his client cannot automatically assign a key to your email address any more (well, you deleted it).

$\endgroup$
6
$\begingroup$

A public PGP key (or "certificate") as seen on the key servers or in your PGP application is a bundle of several pieces of data:

  • A public RSA key (i.e. modulus and public exponent) (or a public key for another signature scheme) – the main key.
  • A bunch of user identities (name, mail address, etc.) for this public key
  • maybe one or several sub keys (for the same or other public key encryption or signature schemes)
  • maybe digital signatures of the subkeys signed by the main key
  • digital signatures of the identities (or combination of main key and identity) signed by the main key
  • maybe digital signatures of any combination of main key and identity, signed by other keys/users. These express trust of these users that your key belongs to a specific identity.

The private key corresponding to your main key and maybe private keys corresponding to the subkeys are the ones protected by your passphrase, but as long as these don't change, your passphrase still works.

There also is a key identifier, which is some kind of hash of the main key.

The identities and subkeys are each signed individually, so you can later add more identities or remove all but one using the command lines explained by Jens – I won't repeat this, as tool usage is off topic here..

Key servers will usually only add data to a key (if it is valid), never remove any, so once your key (with identities) is public, it will stay so. This is a case of The internet never forgets.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.