Frequently Asked Questions about
the Tenhand Keyserver

Last Updated: 10/27/01

Q: Why would I want to use this keyserver?

Because it's not one that the whole world knows about, and it won't copy your keyfile to all of the other servers. This is nice if you want to test things out, or limit the number of people who see your key.

The following questions are from taken from the FAQ at the original MIT keyserver at http://pgp.mit.edu. Minor edits have been made for the local site & to update the content.

Q: How do I extract a key from this keyserver?

A: Extracting a key

  1. Type the text you want to search for in the ``Search String'' box. If you want to look up a key by its hexadecimal KeyID, you have to prefix the ID with 0x
  2. Select either the ``Index'' or ``Verbose Index'' check box. The ``Verbose'' option will display signatures on keys.
  3. Press the ``Do the search!'' button.
  4. The server will return a list of keys matching the search text. The page will have links for every KeyID, and every bracket-delimited identifier (i.e. < marc@mit.edu>). Clicking on the hypertext link will display an ASCII-armored version of the public key.
Extract caveats
  1. The search engine is not the same as that used by the pgp program. It will return information for all keys which contain all the words in the search string. A ``word'' in this context is a string of consecutive alphabetic characters. For example, in the string marc@mit.edu, the words are marc, mit, and edu.

    This means that some keys you might not expect will be returned. If there was a key in the database for Marc Edu , this would be returned for by the above query. If you don't want to see all these extra matches, you can select ``Only return exact matches'', and only keys containing the specified search string will be returned.

    This algorithm does not match partial words in any case. So, if you are used to specifying only part of a long name, this will no longer work.

  2. Currently, hypertext links are only generated for the KeyID and for text found between matching brackets. (It's a common convention to put your e-mail address inside brackets somewhere in the key ID string.)
Q: How do I submit a key to this keyserver?

A: Submitting a key

  1. Generate an ASCII armored version of your public key.
    For example:
    gpg -a --extract myemail@example.com
  2. .Cut-and-paste the resulting ASCII-armored version of your public key into the text box.
  3. Press "Submit".
That's it! The keyserver will process your request immediately. If you like, you can check that your key exists using the extract procedure.
Q: How do I remove a key from the keyserver?

A: This is by far the most frequently asked question I receive. Usually what has happened is user has lost access to his secret key and thus the matching public key on the keyserver is now useless. "Lost access" might mean forgetting the passphrase to the secret key, losing the secring.pgp file, or other similar circumstances. Sometimes users want to remove a key because it contains an old, outdated UserID field (for example, the e-mail address typically listed in the UserID field is no longer valid).

Unfortunately, it is impossible (from a practical point of view) to remove a key from the server's keyring. Yes, I can manually remove a key from the server's keyring using pgp -kr, but that is only a temporary measure. Anyone, not necessary you, can upload a copy of your public key to the keyserver. This is convenient because it means if I wish to sign your public key I can download your key, sign it, and then upload the signed key without ever interacting with you directly. The flip side, though, is that if I remove a key from the keyserver at a user's request there's nothing to prevent that key from being resubmitted to the keyserver by a third party. Some keyserver users periodically submit their entire keyrings to the keyserver (often many MB in size) in order to "resync" with the keyserver. Thus, any key I remove with pgp -kr is likely to re-appear in the future.

The only real way to invalidate a public key is to generate a "key revocation certificate" (KRC) and submit the KRC to the keyserver. A KRC is a special type of signature that indicates that your public key has been compromised. PGP won't use a public key that has a KRC attached to it. Generating a KRC, though, requires access to the corresponding secret key, which means that users who lose access to their secret keyring can't generate a KRC. (See the PGP docs for more information on generating KRCs.) I personally recommend generating a KRC *at key generation time* and storing the KRC on a floppy disk someplace safe; that way even if you lose the secret key you still have a KRC you can submit.

So, what do you do if you can't generate a KRC and removing the key from the keyserver doesn't work? The next best thing I can do is "disable" the public key using pgp -kd. Disabled keys remain present on the server's keyring but cannot be extracted; WWW users actually get a warning message if they try to extract a disabled key. To disable a public key you should send a message (preferrably PGP-signed with your new public key) to pgp-public-keys-request@pgp.ai.mit.edu stating which key(s) you want disabled, and I'll manually process the request.

Note that disabling a key is a local operation; that is, disabling a key on every keyserver's keyring requires having every keyserver operator disable the key manually. KRCs propagate automatically through the keyserver network just like signatures, so you only have to upload a KRC to one keyserver. Please allow some time for "disabling" to propagate through the keyserver network.

Q: I'm interested in running my own keyserver. Where can I get a copy of the source code for your keyserver?

A: The MIT keyserver code is available at dozens of places. Just search for pks-0.9.4.tar.gz on google. Or go to Marc Horowitz's home page