Hacker News Reader

Comment by autodidakto | Hacker News Reader

Anyone know of a good tutorial for revoking and recreating your key as painlessly as possibly?

I'd imagine the process works something like this:

   * Generate the new key
   * Sign the new key with the old key
   * Generate the revocation cert for the old key
   * Push the revocation publicly with a reason of "Superseded by (fingerprint of new key)" or similar
   * Push the new key
   * Try to get your new key signed by everyone that signed your old key for authenticity's sake

I'm not too sure how the community of GPG users out there sees key revocation socially, so you may or may not want to bother with that bit. Perhaps hold off on pushing the revocation until the new key has been in use for a while?

One issue I have noticed is that people do not frequently update their keys from the key servers. Key revocation is not all that useful if you are not periodically checking for published revocations...

And 90% of the time, people want to revoke their old keys because they had a pressing one-time need to have a PGP key (vendor exchange, whatever) and lost the private key without generating and saving a revocation certificate.

This is a place where solid infrastructure support at the OS-level would really help. Instead, it's nerds and the paranoid who bother, and they'll steal the software or insist on open source anyway. :-)

If you do this, will you still be able to decrypt data encrypted with the old key?

Only with the old private key.

I'm sure the man page for gpg can tell you the command line incantation, but I use https://gpgtools.org/ for mac which just has "make key" and "revoke key" buttons.

The tricky bit is just to get your friends to sign your new one, you'll have to re-do all of that work

Reply on news.ycombinator.com