Subject: Re: rfc2440bis-02 comments

From: Dave Del Torto <[email-masked]>
Date: Thu, 4 Jan 2001 16:29:02 -0800

At 10:34 am +0900 2000-12-29, sen_ml [address elided] wrote:
>From: Marc Horowitz [address elided]
>Subject: Re: rfc2440bis-02 comments
>Date: 26 Dec 2000 22:36:38 -0500
>
>  > Why do these people want to delete their keys?
>
>[ text of various reasons deleted ]
>
>  > - I don't want my key on the keyservers at all.
>
>for reference, below is part of an edited recent post from the
>gnupg-users [address elided] mailing list of someone who doesn't
>want their key on a keyserver at all.
>
>perhaps a survey announced on the various user-oriented pgp lists
>would be useful for collecting feedback on the issue of deleting keys
>from keyservers?
>
>Subject: Re: Deleting Keys on Keyservers
>From: Lazarus Long [address deleted]
>To: GnuPG Users List [address elided]
>Date: Thu, 28 Dec 2000 15:50:23 +0000
>
>On Wed, Dec 27, 2000 at 09:49:55PM +0100, Martin wrote:
>  > From: Martin [address deleted]
>
>  > im just curious. Is there a way to delete a key from a keyserver?
>
>Nope.  Once your key is there, you are hanging out there in the wind for
>spambots to come harvest for all eternity.

Indeed, Sen.

Please see: <http://deltor.to/keys/ddt#update>

    dave

________________________________________________________________________
  Dave Del Torto                          tel: +1.415.334.5533 #2
  Executive Director                      web: http://cryptorights.org
  CryptoRights Foundation                 pgp: http://deltor.to/keys/ddt

---

From: "L. Sassaman" <[email-masked]>
Date: Sun, 7 Jan 2001 02:09:13 -0800 (PST)

On 26 Dec 2000, Marc Horowitz wrote:

> Len, exactly what problem is you proposal intended to solve?  You
> said:
>
>     One of the major complaints I hear about PGP key servers is the inability
>     to delete keys once they are sent to the server. I'd like to request the
>     addition of two new flags for subpacket 23:
>
> - They lost the private key or forgot the passphrase.

This doesn't solve that problem. Randy Harmon is putting together some
methods for addressing this issue. However, it could related, as I will
explain.

> - They don't want anybody to know they have a key.

This would aide in suppressing a key whose existence the owner didn't wish
to be public, however.

> - The key is compromised.
>
>   In this case, they should revoke it.

Agreed.

>   Your proposal solves this problem, but in my experience, this almost
>   never happens.

I've encountered cases where this is an issue. I believe Dave Del Torto
has as well.

> or is there another problem I've missed?

One case where I could see this being useful is in a network of privately
run key servers (perhaps in a large organization) that wishes to automate
its key server maintenance. Suppose they have a policy of deleting keys
attached to email addresses that are being deleted. Employee "Bob" leaves,
and the account [email-masked] is deleted. A deletion certificate could be
issued and injected into the key server network. Synchronization would take
care of the deletes on all the servers that this key propagates to.

Now, yes, there is another issue here (that I regrettably forgot to
mention in my original message.) Currently the key-server prefs packet is
denoted as being a "self-signature only" feature. Key servers could have a
policy of permitting specified "admin keys" to make alterations to third
party keys using this packet.

This would also help the public key server admins. Currently, if I sent
you a request to delete my key, and you decided you'd be nice and do so,
what are the chances it would stay deleted? However, if the fact that it
is deleted is merged into the key material, the deletion becomes much more
sticky.

(And only key servers configured to honor your admin key would treat it as
deleted, so I don't see any potential for attack here.)

Those are my reasons in a nutshell. This doesn't solve a lot of the
problems, but it addresses some of them, and it hurts nothing.

__

L. Sassaman

Security Architect             |  "The world's gone crazy,
Technology Consultant          |   and it makes no sense..."
                               |
http://sion.quickie.net        |                   --Sting