keybase / keybase/client

Completely (as much as possible) replace GPG key on account

Open
#24,594 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
9.2k
Forks
1.3k
Avg merge
12h 58m
Merged PRs (30d)
56

Description

Hi,

I generated a key using keybase pgp gen, but this created a 4096-bit RSA key. I want to create an ECC key due to the security and efficiency benefits of this newer algorithm.

I am trying to completely replace my key on Keybase. I used the option in the Mac client to "drop" the key, and then I ran keybase pgp purge and keybase pgp purge -p. I now have a few concerns:

  1. When I generated the key using keybase pgp gen, the program mentioned something about uploading the PGP key to Keybase's encrypted secret keystore, so I selected this option. How can I remove the secret key from this secret keystore?
  2. How can I revoke my key? I know that in dropping the key, I have issued a statement in my sigchain stating that the key is not valid, but is this the same thing as a PGP revocation signed with the secret key? That is, if someone uploaded my key to a keyserver or downloaded my key for use outside of Keybase, can I upload a revocation certificate to the Keybase server so that they are made aware that the key is no longer used when they try to encrypt or verify something using my public key?
  3. In the Keybase Mac client (under the Crypto tab), I can still sign messages, encrypt messages to myself, and decrypt them. However, on the website, when I try to encrypt a message to myself, I get an error saying that I do not have a public key on my account (I haven't yet generated my new ECC key). So, (a) how is the Keybase client signing, encrypting, and decrypting messages if I don't have a public key on my account, and (b) why is the website behaving differently? This is concerning because when I add my new key, I don't want messages encrypted with the Keybase client ciphered with the superseded key while messages encrypted on the website are ciphered with the new key.

Basically, what I am trying to ask is: how can I reset my Keybase account to the way it was before I generated the RSA key? I know that I won't be able to remove the key and its revocation from my public sigchain, but how can I indicate that this old key is never to be used again?

And, finally, how do I use keybase pgp gen to create a private key using a particular ECC curve? I can't find anything about keybase pgp gen anywhere in the documentation.

I appreciate any help that you can offer!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the reported behavior of keybase pgp gen, keybase pgp purge, keybase pgp purge -p, the Mac Crypto tab, and website encryption. Document how to remove or revoke the old key, how client and website encryption differ, and how to generate an ECC key with a selected curve.

Written by the indexing model from the issue text.

Assessment

Domain
cryptography, documentation, security
Issue type
Documentation
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
15/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.