bits 0x46 - Calender Week 12, 2024

public keyservers … am I doxing myself?

One feature of keyservers is, if you upload a certificate, it never goes away.

And in most cases, the certificates are only monotonic incremental, the problem is, you can not remove a subkey or keyid without revoking it, and even if you revoked it, the information together with the revocation cert, stays on the keyserver.

For example, here is my pgp key: here I have 3 keyids and 2 subkeys.

$ gpg --list-secret-keys -------------------------------
sec   rsa4096 2020-06-07 [SC]
      DA2939BC46EF7A36FA08B89FBBEEC43923F0E695
uid           [ultimate] shrik3 <shrik3@riseup.net>
uid           [ultimate] shrik3 <shrik3@vnil.org>
uid           [ultimate] Tianhao Wang (school mail) <tianhao.wang2@mailbox.tu-dresden.de>
ssb   rsa4096 2020-06-07 [E] [expires: 2025-12-11]
ssb   rsa4096 2022-11-15 [S] [expires: 2025-12-11]

Once the pubkey is uploaded to a keyserver, there is no going back. If I decided that I shouldn’t associate my name and school email to my legal name, I can only revoke those identities by uploading a revocation cert. It’s impossible to take it down for good¹.

As matter of fact I’m already regretting uploading my certificates to the keyservers. Anyways from now on I won’t upload any certificate to keyservers other than openpgp anymore…

Why monoton?
It may sound horrible that your information can’t be deleted from the keyserver, but there are some certain security concerns. For example if the revoked identities and keys are removed from the keyserver together with the revocation cert

• For people who do not have your old certificates, there is no way to validate a signature created before the revocation.
• For people who already hold your old certificates, there would be no way to pass the words “hey, xyz is revoked, don’t use them anymore”: They will not invalidate a subkey or identity unless they see a revocation cert

spamming?
I can imagine a DoS attack on the keyservers…..

Fuck it, I’ll fix it myself

One good thing about open source is that if a program is broken or missing some features, I can

Latex

https://tug.org/levels.html
https://xkcd.com/2347/
https://en.wikipedia.org/wiki/Monotype_system
https://tex.stackexchange.com/a/244126
https://ultrasparky.org/school/pdf/Rhatigan_Monotype_4-line_math.pdf

Good Reads

Learn X in Y Minutes
What’s the matter with PGP? - by Matthew Green
GPG And Me
Ligatures in programming fonts: hell no
Inside Yubikey Neo