Key server (cryptographic)
In computer security, a key server is a computer that receives and then serves existing cryptographic keys to users or other programs. The users' programs can be running on the same network as the key server or on another networked computer.
The keys distributed by the key server are almost always provided as part of a cryptographically protected public key certificates containing not only the key but also 'entity' information about the owner of the key. The certificate is usually in a standard format, such as the OpenPGP public key format, the X.509 certificate format, or the PKCS format. Further, the key is almost always a public key for use with an asymmetric key encryption algorithm.
History
Key servers play an important role in
The first web-based
Enterprise PGP
A separate key server, known as the PGP Certificate Server, was developed by
on the key server concept.To replace the aging Certificate Server, an
PGP Keyserver 7 was later replaced by the new PGP Corporation PGP Global Directory of 2011 which allows PGP keys to be published and downloaded using HTTPS or LDAP.[4]
OpenPGP
The OpenPGP world largely used its own development of keyserver software independent from the PGP Corporation suite. The main software used until the 2019 spamming attack was "SKS" (Synchronizing Key Server), written by Yaron Minsky.[5] The public SKS pool (consisting of many interconnected SKS instances) provided access via HKPS (HLP with TLS) and HTTPS. It finally shut down in 2021 following a number of GDPR that it was unable to process effectively.[6]
A number of newer pools using other software has been made available following the shutdown of the SKS pool, see #Keyserver examples.
Public versus private keyservers
Many publicly accessible key servers, located around the world, are computers which store and provide
Several publicly accessible S/MIME key servers are available to publish or retrieve certificates used with the S/MIME cryptosystem.
There are also multiple proprietary public key infrastructure systems which maintain key servers for their users; those may be private or public, and only the participating users are likely to be aware of those keyservers at all.
Problems with keyservers
Lack of retraction mechanism
The OpenPGP keyservers since their development in 1990s suffered from a few problems. Once a public key has been uploaded, it was purposefully made difficult to remove it as servers auto-synchronize between each other (it was done in order to fight government censorship). Some users stop using their public keys for various reasons, such as when they forget their pass phrase, or if their private key is compromised or lost. In those cases, it was hard to delete a public key from the server, and even if it were deleted, someone else can upload a fresh copy of the same public key to the server. This leads to an accumulation of old fossil public keys that never go away, a form of "keyserver plaque".
The lack of a retraction mechanism also breached the European General Data Protection Regulation, which was cited as a reason for the closure of the SKS pool.[6] Modern PGP keyservers allow deletion of keys. Because only the owner of a key's e-mail address can upload a key (see next section) in such servers, the key stays deleted unless the owner decides otherwise.
Lack of ownership check
The keyserver also had no way to check to see if the key was legitimate (belong to true owner). As consequence anyone can upload a bogus public key to the keyserver, bearing the name of a person who in fact does not own that key, or even worse, use it as vulnerability: the Certificate Spamming Attack.[5][7]: §2.2
Modern keyservers, starting with the PGP Global Directory, now use the e-mail address for confirmation. This keyserver sent an email confirmation request to the putative key owner, asking that person to confirm that the key in question is theirs. If they confirm it, the PGP Global Directory accepts the key. The confirmation can be renewed periodically, to prevent the accumulation of keyserver plaque. The result is a higher quality collection of public keys, and each key has been vetted by email with the key's apparent owner. But as consequence, another problem arise: because PGP Global Directory allows key account maintenance and verifies only by email, not cryptographically, anybody having access to the email account could for example delete a key and upload a bogus one.
The last Internet Engineering Task Force draft for HKP also defines a distributed key server network, based on DNS SRV records: to find the key of [email protected], one can ask it by requesting example.com's key server.
Leakage of personal relationships
For many individuals, the purpose of using cryptography is to obtain a higher level of privacy in personal interactions and relationships. It has been pointed out that allowing a public key to be uploaded in a key server when using decentralized web of trust based cryptographic systems, like PGP, may reveal a good deal of information that an individual may wish to have kept private. Since PGP relies on signatures on an individual's public key to determine the authenticity of that key, potential relationships can be revealed by analyzing the signers of a given key. In this way, models of entire social networks can be developed. (Mike Perry's 2013 criticism of the Web of Trust mentions the issue as already been "discussed at length".)[8]
A number of modern key servers remove third-party signatures from the uploaded key. Doing so removes all personal connections into the Web of Trust, thus preventing any leakage from happening. The main goal, however, was to minimize the storage space required, as "signature spamming" can easily add megabytes to a key.[9][7]: §2.1
Keyserver examples
These are some keyservers that are often used for looking up keys with gpg --recv-keys
.[10] These can be queried via https://
(HTTPS) or hkps://
(HKP over TLS) respectively.
- keys.openpgp.org
- keys.mailvelope.com/manage.html
- pgp.mit.edu
- keyring.debian.org (only contains keys from Debian project members)
- keyserver.ubuntu.com (default in GnuPG since version 2.3.2)
- pgp.surf.nl
See also
References
- ^ Horowitz, Marc (1996-11-18). "A PGP Public Key Server". Retrieved 2018-05-02.
- ^ Shaw, David (March 2003). "The OpenPGP HTTP Keyserver Protocol (HKP)". Internet Engineering Task Force. Retrieved 2018-05-02.
- ^ Cryptographic system and methodology for creating and managing crypto policy on certificate servers
- ^ "PGP Global Directory - Terms and Conditions".
- ^ a b "SKS Keyserver Network Under Attack". Gist. Retrieved 2020-09-17.
- ^ a b "SKS Keyservers". Archived from the original on 2022-01-19.
- ^ a b Gillmor, Daniel Kahn (18 August 2023). "Abuse-Resistant OpenPGP Keystores [draft-dkg-openpgp-abuse-resistant-keystore-06]". Internet Engineering Task Force.
- ^ Perry, Mike (Sep 29, 2013). "[tor-talk] Why the Web of Trust Sucks".
- ^ "keys.openpgp.org FAQ". keys.openpgp.org.
- ^ "recv-keys documentation". GPG Manual. Retrieved 30 June 2020.
External links
- List of Key Servers at Curlie
- The OpenPGP HTTP Keyserver Protocol (HKP) (March 2003)
- OpenPGP Public Key Server on BSD-style license. It has largely been replaced by SKS and Hockeypuck.
- Synchronizing Key Server (SKS) - an OpenPGP key server software package distributed under the GPL.
- Hockeypuck - a synchronising OpenPGP keyserver software package distributed under the AGPL.
- Hagrid - a non-synchronising, verifying OpenPGP keyserver software package distributed under the AGPL.
- PGP Global Directory hosted by the PGP Corporation.