the revocation blues

this certainly presents a challenge for the trust web.
i suppose the key ring needs a "kill" list.

		peter

------- Forwarded Message

Newsgroups: alt.security.pgp,sci.crypt
From: perry@jpunix.com (John A. Perry)
Subject: Key Revocation Problems
Organization: J. P. and Associates, Dickinson, TX
Date: Tue, 16 Feb 1993 23:56:35 GMT
Message-ID: <C2KFuC.7Iw@jpunix.com>
Keywords: PGP keys

- -----BEGIN PGP SIGNED MESSAGE-----

Hello Everyone!

	Several of us have been wrestling with a key revocation
problem for some time now. When I first installed PGP 2.1 I had a
weird chain of events follow. I generated my personal key and sent a
copy of my public key to Vesselin Bontchev and Ken van Wyk. This key
was posted to one of the large keyrings almost immediately. Several
hours later, I was still playing with PGP and suffered a disk crash. I
had not yet had a chance to back up my keyring. Needless to say, I
lost the keyring and now I have no way to revoke the key. The specific
key I'm talking about is 0x76A3. The key I currently use, 0xB199 is
the one I plan on using from now on. It is backed up frequently of
course. About a week ago I sent a signed message to Vesselin
explaining the problem and he agreed to add his own comments, sign it,
and post it to alt.security.pgp and sci.crypt. The message seems to
have fallen through the cracks which is why I'm posting this message.
I'm sure if Vesselin, explorer@iastate.edu, and warlord@mit.edu are
reading this, they will add their own verifications of this problem.
If I receive the errant message from Vesselin, I'll repost it also.

	In the meantime, if you feel this is enough verification to
remove the public key 0x76A3 from your public keyring, I sure would
appreciate it. If you require further verification, I will be glad to
discuss it on the phone. My home number is 713-534-3653 and my work
number is 409-772-2706 (the secretary). I apologize for any
inconvenience. At least this fluke chain of events may show everyone
the importance of backing up your PGP keyrings often.

	Remember 0xB199 is the good one!!



- -----BEGIN PGP SIGNATURE-----
Version: 2.1e

iQCVAgUBK4F/K1oWmV4X/7GZAQHRvAP/QYDZU8xD7v4y4SJbE1bgp2FVTQWOt106
YJjOAXSyKQuZKQVxLOSF2c4kq0PS3+kUQedWTvccxB6koUAp6gscBg4UFWYQAQc5
Tu5QIE/c9XHhmergEKGpVz9GDVPiolMJbKh3Ni6q/Wul8T65vtT+y9alN8KDIJZt
IGTeSspNtVo=
=whcq
- -----END PGP SIGNATURE-----
- -- 
 John A. Perry  -  perry@jpunix.com
                   jpunix!perry

 PGP 2.1 signature available by fingering perry@phil.utmb.edu

------- End of Forwarded Message

peter honeyman <honey@citi.umich.edu>
>this certainly presents a challenge for the trust web.
>i suppose the key ring needs a "kill" list.

From: perry@jpunix.com (John A. Perry)
>Several of us have been wrestling with a key revocation
>problem for some time now.
>Several
>hours later, I was still playing with PGP and suffered a disk crash. I
>had not yet had a chance to back up my keyring. Needless to say, I
>lost the keyring and now I have no way to revoke the key.

I don't get it. The point of revocation is to remove a *compromised*
key, one that someone has potentially copied, etc.  If there is no
chance that the key can be accessed, how is this a problem? I guess the
problem is that only one key can be associated with one person
(identity) per keyring?  Then I would say the thing to do is propagate
the new key through the trust network in the same way it was originally
established...? This isn't really a deficiency in the software, is it?