What to do with a PGP/GPG key to which I've lost the private key?

Question

I created a private key with an Android app I'm no longer using. I had uploaded the public key to the keyservers without setting an expiry date. I later deinstalled that app, and deinstalling apparently deleted the private key, or else I can't find it on my phone.

From time to time, people try to send me an email encrypted in that old key, because they don't know that I don't have access to the private key. Is there any way of revoking the key on the keyserver or adding a comment to prevent people from doing this? (I didn't create a revocation certificate.)

I pretty much answered this question on Ask Ubuntu already: "Lost PGP private key and want to remove it from keyserver.ubuntu.com". — Jens Erat, Jul 09 '15 at 10:06
@JensErat, and the short version of your answer is basically "There is no sensible way to do this." Fair enough. — Turion, Jul 09 '15 at 10:09
This question seems to have a correct and full answer. If you agree, mark it :). — dan, Aug 10 '15 at 14:05
@daniel, I think Jens' answer on Ask Ubuntu is more exhaustive. And neither answer actually solves the problem, they just explain that there is no solution. — Turion, Aug 10 '15 at 15:58
I fully agree. And sometimes the correct answer is the reference to a better one, and the truth that there is no solution. — dan, Aug 10 '15 at 16:51

score 1 · Answer 1 · edited Apr 13 '17 at 12:22

You normally would revoke the key:

Revocation is described in the link to another question on ask Ubuntu.

Basically:

The "OpenPGP way" to remove old keys is to mark them as revoked by uploading special revocation certificates. These will tell other OpenPGP users that your key is superseded.

Revoking keys is not possible if you don't have access to the private key, defined a designated revoker or a pregenerated revocation certificate.

Unfortunately, as you don't have access to the private key you wont be able to. Instead, you'll want to generate a new one and, if possible, let your contacts know via some other medium that your key has changed and they will need to use the new one. Often people post keys on twitter or to some other location only they control. If possible change your keys there to a new key and this time be sure to setup a revocation cert.

What to do with a PGP/GPG key to which I've lost the private key?

1 Answers1