Re: Revoking Old Lost Keys

At 7:07 AM 1/6/96, Bruce Baugh wrote:

>I'd like to bring up a problem I haven't seen addressed much yet, and which
>I think is going to come up with increasing frequency as PGP use spreads.
>
>The problem is this: how can one spread the word that an old key is no
>longer to be used when one no longer has the pass phrase, and cannot
>therefore create a revocation certificate?

Basically, you are screwed. Any revocation you attempt will not be trusted,
as we will suspect the new "you" to be an attacker, perhaps an agent of the
NSA or the Illuminati. In the view that "you are your key," the old you no
longer exists.

Perhaps you could just move to a different city, change your name, and
create a new key. (However, be sure you write down your passphrase and
other salient information to handle your next memory loss.)

>
>In my case the problem is medical: thanks to autoimmune problems, I get
>random memory loss from time to time. Sometimes it's big - like an entire
>semester of my sophomore year of college. Sometimes it's small - like three
>old pass phrases. So there are keys of mine floating around the key servers
>that I don't want used, and which are just taking up space.

Pardon me for being politically incorrect (*), but anyone who has these
sorts of memory lapses should certainly write down the passphrases! While
it is true that writing down a passphrase increases the risk slightly that
a black bag operative will sneak into one's house and use his Minox to
record the passphrases, in practice this is a minor risk. Especially
compared to the immediate risk of losing or forgetting the passphrase.

(* I said I was being "politically incorrect" because I've found that
people these days don't want their defects and weaknesses commented upon by
others, even when they mention them themselves. Thus, cripples don't want
anyone to comment on their handicaps, and so on. Someone on this list with
"Multiple Personality Disorder" got mightily offended when someone else
mentioned MPD in a joking way in a post. Others freak out at innocent
remarks, seeing their own demons.)

So, if you are losing entire semesters worth of memory, you might want to
start writing a lot of stuff down.

Seriously, this is an example where "escrow" works. Seal an envelope with
your passphrase and any other stuff you want to remember, and leave it with
your lawyer or escrow agency with instructions to only turn it over to you.
Same as a safe deposit box, unless you forget the key. (You could forget
you have a lawyer, so better write that down somewhere, too.)

I've not forgotten my PGP passphrase, but then I've only had one PGP key in
the last several years and I've written a note to myself someplace which
describes what the passphrase is in terms I think would only be meaningful
to me. Not fully secure, but nothing really is. And secure enough.

If you've had several keys in several years, and yet you are risk of
forgetting entire semesters, maybe you ought to think about whether
encryption is all that necessary for you. (I rarely see the need to
encrypt, even as I cherish the ability and present right to encrypt, so I
naturally wonder what it is all these people who seem to be encrypting
nearly every private message they send are really concerned about....just
my opinion.)

I hope all turns out well, and I hope my candid answers to your questions
are not too politically incorrect.

--Tim May


We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^756839 - 1  | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

Timothy May wrote:
> At 7:07 AM 1/6/96, Bruce Baugh wrote:
> 
> >I'd like to bring up a problem I haven't seen addressed much yet, and which
> >I think is going to come up with increasing frequency as PGP use spreads.
> >
> >The problem is this: how can one spread the word that an old key is no
> >longer to be used when one no longer has the pass phrase, and cannot
> >therefore create a revocation certificate?
> 
> Basically, you are screwed. Any revocation you attempt will not be trusted,
> as we will suspect the new "you" to be an attacker, perhaps an agent of the
> NSA or the Illuminati. In the view that "you are your key," the old you no
> longer exists.
> 
...
> 
> Seriously, this is an example where "escrow" works. Seal an envelope with
> your passphrase and any other stuff you want to remember, and leave it with
> your lawyer or escrow agency with instructions to only turn it over to you.
> Same as a safe deposit box, unless you forget the key. (You could forget
> you have a lawyer, so better write that down somewhere, too.)

Escrow is orthogonal to the underlying problem here, which is that the
PGP revocation model is completely wrong.  Since the trust properties
and other semantics of a key originate with the certificates attached to
the key, and not from the key owner per se, it makes little sense to make
the key owner responsible for revoking that trust.  Far more sensible would
be a scheme in which the certificate issuers themselves could revoke their
certificates when they believe a key is no longer trustworthy.  (A practical
decentralized system like PGP could provide a facility for certifiers to
"pre-revoke" their certificates at the time they are issued so that the key
owner could distribute the revocation certificates himself if he discovers
his own key to have been compromised or lost.)

Note that the problem here is in the basic trust model, not just the
certificate distribution model (which is a separate problem).  The lack of
ability for a certifier to revoke his own certification, plus the lack of a
facility to put limits on the duration and meaning of the certification,
make PGP certificates of very limited practical value.

-matt

> Note that the problem here is in the basic trust model, not just the
> certificate distribution model (which is a separate problem).  The lack of
> ability for a certifier to revoke his own certification, plus the lack of a
> facility to put limits on the duration and meaning of the certification,
> make PGP certificates of very limited practical value.

Isn't the last bit here, the part about duration and meaning, the 
practical answer to the problem?  Especially duration?

The stuff that's been going on lately with Netscape's browsers, Sameer's
apache ssl server, and the difficulty of getting CAs like verisign to
approve keys underscores the importance of this issue.

This is probably sort of half-baked, but is it possible to come up with a 
formal grammar that would allow us to describe trust models in general?  
What if we had a prolog-like system that allowed you to set up rules like:

"x is a student if x has got a signature from a school" 
"x is a school if x has got a signature from the accredation authority"
"x belongs to the secret society of x has signatures from 3 other people
who have belonged to the society for more than a year, and if x is 
a certified owner of a duck."

Wouldn't something like this give us the flexibility to use a PGPish model
of trust or an X.509ish model, or whatever else we wanted to do?

It seems to me that the rules that govern when you can accept which 
signature ought to be data objects in a more flexible system, just as the 
signatures themselves are data objects.  That means that the rules 
themselves ought to be subject to change, revokation, or revision.  

The constitution wouldn't have survived if it didn't contain a mechanism 
for ammendment.  Wouldn't a model of trust with the same ability for 
revision and extension be a lot more robust, and a lot more resistent to 
centralized control?

> > Note that the problem here is in the basic trust model, not just the
> > certificate distribution model (which is a separate problem).  The lack of
> > ability for a certifier to revoke his own certification, plus the lack of a
> > facility to put limits on the duration and meaning of the certification,
> > make PGP certificates of very limited practical value.
> 
> Isn't the last bit here, the part about duration and meaning, the 
> practical answer to the problem?  Especially duration?
> 
> The stuff that's been going on lately with Netscape's browsers, Sameer's
> apache ssl server, and the difficulty of getting CAs like verisign to
> approve keys underscores the importance of this issue.
> 
> This is probably sort of half-baked, but is it possible to come up with a 
> formal grammar that would allow us to describe trust models in general?  
> What if we had a prolog-like system that allowed you to set up rules like:
> 
> "x is a student if x has got a signature from a school" 
> "x is a school if x has got a signature from the accredation authority"
> "x belongs to the secret society of x has signatures from 3 other people
> who have belonged to the society for more than a year, and if x is 
> a certified owner of a duck."
> 
> Wouldn't something like this give us the flexibility to use a PGPish model
> of trust or an X.509ish model, or whatever else we wanted to do?
> 
> It seems to me that the rules that govern when you can accept which 
> signature ought to be data objects in a more flexible system, just as the 
> signatures themselves are data objects.  That means that the rules 
> themselves ought to be subject to change, revokation, or revision.  
> 
> The constitution wouldn't have survived if it didn't contain a mechanism 
> for ammendment.  Wouldn't a model of trust with the same ability for 
> revision and extension be a lot more robust, and a lot more resistent to 
> centralized control?
> 

Indeed, I agree that's the right approach.  In fact, I agree so much
that I've spent the last few months (with Joan Feigenbaum and Jack
Lacy) developing the principles and structure for just such a "trust
management" system.  Watch this space for details of our system, called
"PolicyMaker", which I expect to release a paper about shortly and a
reference implementation around April or May.

-matt