- Because bob is a bit scatterbrained, he decides to create a revocation certificate for his new keys. This will allow him to revoke his old keys, and let people know about it through a keyserver
- Bob uses
--gen-revoke to create the certificate:
[bob@yohost bob]$ gpg --gen-revoke bob
sec 1024D/A9187B27 2003-01-29 Bob Smith (User Bob)
Create a revocation certificate for this key? yes
Please select the reason for the revocation:
1 = Key has been compromised
2 = Key is superseded
3 = Key is no longer used
0 = Cancel
(Probably you want to select 1 here)
Your decision?
Invalid selection.
Your decision? 3
Enter an optional description; end it with an empty line:
>
Reason for revocation: Key is no longer used
(No description given)
Is this okay? yes
You need a passphrase to unlock the secret key for
user: "Bob Smith (User Bob) "
1024-bit DSA key, ID A9187B27, created 2003-01-29
ASCII armored output forced.
Revocation certificate created.
Please move it to a medium which you can hide away; if Mallory gets
access to this certificate he can use it to make your key unusable.
It is smart to print this certificate and store it away, just in case
your media become unreadable. But have some caution: The print system of
your machine might store the data and make it available to others!
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
Comment: A revocation certificate should follow
iEkEIBECAAkFAj44QwsCHQMACgkQ8iO+oKkYeyc57gCfaAAoa4WE8iT07euoYqBH
eL9eRB4An1AsL3mWC4UI926xVKlJpJ1QqkFm
=lCql
-----END PGP PUBLIC KEY BLOCK-----
- Bob now has a revocation certificate, which he can store in a safe place in case he loses his keys
- To actually use the certificate, bob has to import it into his keyring:
[bob@yohost bob]$ gpg --import
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
Comment: A revocation certificate should follow
iEkEIBECAAkFAj44QwsCHQMACgkQ8iO+oKkYeyc57gCfaAAoa4WE8iT07euoYqBH
eL9eRB4An1AsL3mWC4UI926xVKlJpJ1QqkFm
=lCql
-----END PGP PUBLIC KEY BLOCK-----
gpg: key A9187B27: revocation certificate imported
gpg: Total number processed: 1
gpg: new key revocations: 1
- bob can no longer use that key:
[bob@yohost bob]$ gpg --encrypt hello.txt
You did not specify a user ID. (you may use "-r")
Enter the user ID: bob
No such user ID.
Enter the user ID: bob@localhost
No such user ID.
- Now bob creates new keys for himself, and lets everyone know that his old keys are revoked.