From: "L. Detweiler" <ld231782@longs.lance.colostate.edu>
Date: Fri, 19 Feb 93 11:08:08 PST
To: peter honeyman <honey@citi.umich.edu>
Subject: Re: the revocation blues
In-Reply-To: <9302190448.AA10424@cygnus.com>
Message-ID: <9302191906.AA05283@longs.lance.colostate.edu>
MIME-Version: 1.0
Content-Type: text/plain


peter honeyman <honey@citi.umich.edu>
>this certainly presents a challenge for the trust web.
>i suppose the key ring needs a "kill" list.

From: perry@jpunix.com (John A. Perry)
>Several of us have been wrestling with a key revocation
>problem for some time now.
>Several
>hours later, I was still playing with PGP and suffered a disk crash. I
>had not yet had a chance to back up my keyring. Needless to say, I
>lost the keyring and now I have no way to revoke the key.

I don't get it. The point of revocation is to remove a *compromised*
key, one that someone has potentially copied, etc.  If there is no
chance that the key can be accessed, how is this a problem? I guess the
problem is that only one key can be associated with one person
(identity) per keyring?  Then I would say the thing to do is propagate
the new key through the trust network in the same way it was originally
established...? This isn't really a deficiency in the software, is it?