On Jun 27, 2010, at 4:27 PM, Dan Mahoney, System Admin wrote:

> On Sun, 27 Jun 2010, David Shaw wrote:
> 
>> On Jun 27, 2010, at 3:58 PM, Dan Mahoney, System Admin wrote:
>> 
>>> All,
>>> 
>>> How difficult would it be to propose some kind of extension flag to the PGP 
>>> key format that in essence says "don't publish me to a keyserver". Note 
>>> that I'm asking from a technical point of view, not a social (i.e. making 
>>> servers support it) or IETF one (insert bikesheds here).
>>> 
>>> My question is: Is it possible to do in such a way that keys would be 
>>> backward-compatible?
>> 
>> Not only is it possible, it already exists.  GnuPG can even set it and unset 
>> it, as you like.
> 
> Really?  Where is it?

It's a flag that can be set on a key user ID, similar to cipher or compression 
preferences.  Run "--edit-key" on a key, and enter "showpref" or "pref".  You 
will probably see a mention of "Keyserver no-modify" (or "no-ks-modify").  You 
can turn it on and off with setpref, like any other preference: "ks-modify" 
allows keyserver modifications, and "no-ks-modify" disallows them.

Note that the definition of no-modify is that only the keyholder (or the 
administrator of the keyserver) can override it.  So the flag only applies to 
other people - the keyholder can choose to upload his key if he so desires.

> Also, is it possible for either the manpage or the interactive help to 
> include the meaning of the various preferences that are not cipher types?

Sure enough, it's not in the man page.  I'll fix that.

>> It's effectively a no-op though, as no server supports it.
> 
> I'm looking into making mods to at least one server type (we run one locally 
> at work), and commit them upstream.  If I'm going to wade into that muck, I 
> might as well have multiple things to try to make work.
> 
> The change in the key file format is the "hard" part :)

Having keyservers support no-modify requires that they first support crypto at 
all.  That's a really big step.

David


_______________________________________________
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Reply via email to