Re: [openpgp] email death certificates

[David Shaw <[e-mail]>]

On Aug 23, 2019, at 8:03 PM, Michael Richardson <[e-mail]> wrote:
> 
> 
> David Shaw <[e-mail]> wrote:
>>> Has anyone given any thought to this?
>>> 
>>> I suppose it might also apply to "does not work here anymore"
> 
>> There is a "Reason for Revocation" subpacket for the revocation
>> signature.  It contains both a machine-readable byte giving various
>> reasons for revocation (key superseded, compromised, or retired, user
>> ID no longer valid, or a general "other"), followed by a human-readable
>> string.
> 
>> I suppose a death notification would be "key retired", with additional
>> information (if any) given in the human-readable string.  This works
>> with the designated revoker feature as well as the regular (self)
>> revocation, so even if the private key is missing (or, being dead, the
>> owner is unable to enter a passphrase) the key can still be revoked.
> 
> The designated revoker is singular.
> 
> There is no k-of-n (or rather K) threshold the way that signature on UIDs
> works.  If there was N signatures binding [e-mail] to key 0x12345678,
> then it would be nice if the self-sign on the key could set a value k,
> which if at least K entities revoke their signature (not just expire) with
> an identical reason, would signal that the key<->UID is no longer valid.

Designated revoker is not quite singular.  You can have more than one designated revoker on a given key - it is true, though, that any single one of them can revoke the key.

I'd be somewhat afraid to use a scheme where people not chosen by me could "gang up" and cause a UID to be revoked.  Or for that matter, a single angry person could make N keys, sign the UID and then revoke that signature with each of those N keys.

Designated revoker lets me, as the key owner, pick who is allowed to kill my key.

David