5

Is it possible to decrypt a message which is encrypted with a revoked PGP key? I still have the private key, but Enigmail doesn't show me revoked keys neither does automatic decryption.

Edit: I created a new key pair, but some people still use my old one. I want to be able to decrypt these messages of course.

Tom Maier
  • 125
  • 1
  • 6
  • As a workaround you could probably make a new key chain containing the (unrevoked) old key and temporarily use that. – Maarten Bodewes May 22 '15 at 14:13
  • 3
    In WoT, key revocation is more about invalidating authenticity than it is removing access - i.e.: there's no logical reason why a client shouldn't be able to decrypt with a revoked key, but anyone verifying a signature (who's been notified of the key being revoked) should be seeing a big red flag. – Iszi May 22 '15 at 14:17

1 Answers1

2

Yes, after you revoke your key you can still decrypt messages sent to you encrypted with that key.

Note that you are also able to decrypt messages sent to you with the revoked key after the revocation. In fact, even if people aren't supposed to use that key (GPG/Enigmail will not allow to use a revoked public key to encrypt a message to someone), many of them could still have your public key when it was still valid and haven't refreshed it since then.

You should send to these people your new public key and your revoked old public key so they can update their keyring; afterwards, they'll be able to use only your new key. Alternatively, if you've uploaded your keys to a keyserver, tell them to refresh their keyring from Enigmail Key Management: they have to select your public key and choose Keyserver -> Refresh selected public keys (or Refresh all public keys to refresh all keys in the keyring).

Enigmail should show you revoked keys as well. If it doesn't, open Enigmail Key Management, go to View and make sure Display invalid keys is ticked.

dr_
  • 5,060
  • 4
  • 19
  • 30
  • Thank you very much for the detailed response. I figured out that you're right recently. The sender used a foreign key instead of mine. So he tried to send me a mail again with my old (revoked) key and I was able to decrypt the message as you said. – Tom Maier May 24 '15 at 15:23