31
$\begingroup$

After revoking a key and sending the revocation to MIT's keyserver, I noticed that the key is listed as such:

pub  2048R/XXXXXXXX 2011-01-01 *** KEY REVOKED *** [not verified]

Who is responsible for the 'verification of the revocation'? Does the owner of the key do this verification? If so, how is this accomplished? Do other people sign the revocation and at a certain point it becomes verified?

Improve this question
$\endgroup$
2
  • 3
    $\begingroup$ I don't get this note either, but I do notice that all of the revoked keys I've seen on MIT's keyserver have this. $\endgroup$
    – gertvdijk
    Apr 23, 2013 at 0:10
  • 1
    $\begingroup$ I believe e-sushi is correct, the keyserver accepted a packet that met the criteria of a key revocation certificate for that key, but does not perform a cryptographic check on that certificate. When you pull from your gpg client, it should do that check. $\endgroup$
    – Jared
    Jun 29, 2020 at 16:43

2 Answers 2

Reset to default
10
$\begingroup$

How does one verify a key revocation?

As Jon Callas already stated: you simply don’t.

In case a different wording helps, here’s a quote related to the exact same question… https://lists.gnupg.org/pipermail/gnupg-users/2014-February/049100.html

…

I revoked my key and on the public key server it says: "* KEY REVOKED * [not verified]" Why does it say that revocation is not verified?

That probably refers to the point that the keyservers don't do crypto checks. It means: There is a packet which looks like a key revocation but it could be forged. If an OpenPGP application downloads the key from the server then it does a signature check.

…

Improve this answer
$\endgroup$
8
$\begingroup$

No, the user of the key does. A revocation issued by the key itself, or by a designated revoker, which is some different key.

If I am going to encrypt to you, I look at the key before I do, and I look to see if your key is revoked. Similarly, if I am verifying a signature your key made, I look to see if the key is revoked.

Improve this answer
$\endgroup$
3
  • 4
    $\begingroup$ The key was revoked using the revocation cert and then sent to the keyserver. I am unsure which step of the process I am leaving out. $\endgroup$
    – earthmeLon
    Jun 20, 2012 at 4:06
  • $\begingroup$ So it's not possible to make the key disappear from the keyserver? (i.e. "trigger" the verification on the server side, which IIUC should be followed by removal from the listing?) $\endgroup$
    – Alois Mahdal
    Oct 16, 2014 at 18:37
  • $\begingroup$ @AloisMahdal "make the key disappear from the keyserver" --- keyservers don't delete data by design. $\endgroup$
    – berbt
    Jul 27, 2016 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.