From f795da774dc5c0f87d26c2c79690aae792375a95 Mon Sep 17 00:00:00 2001 From: "Tammi L. Coles" Date: Thu, 23 Nov 2023 14:24:05 +0100 Subject: [PATCH] edit ch8 Revocation self-signatures --- book/source/08-signing_components.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/book/source/08-signing_components.md b/book/source/08-signing_components.md index ff62e06..7b5e4ff 100644 --- a/book/source/08-signing_components.md +++ b/book/source/08-signing_components.md @@ -168,22 +168,22 @@ In OpenPGP v6, a direct key signature is the [preferred mechanism](https://www.i In an OpenPGP certificate, one User ID serves as the [*primary* User ID](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-primary-user-id). The metadata in the binding self-signature on this User ID applies to the certificate's primary key. -### Revocation self-signatures: Invalidating components of a certificate +### Revocation self-signatures: Invalidating certificate components -One important class of self-signatures are revocations. +Revocation self-signatures represent an important class of self-signatures, used primarily to invalidate components or retract prior signature statements. -A revocation signature is used to invalidate a component, or retract the statement formed by a prior signature. +There are several types of revocation signatures, each serving a specific purpose: -- A [*key revocation signature*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-revocation-signature-ty) (type ID `0x20`) marks a primary key as revoked. -- a [*subkey revocation signature*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-subkey-revocation-signature) (type ID `0x28`) revokes a prior subkey binding signature, while -- a [*certification revocation*](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-certification-revocation-si) (type ID `0x30`) revokes a certification signature. +- A [**key revocation signature**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-key-revocation-signature-ty) (type ID `0x20`) marks a primary key as revoked. +- A [**subkey revocation signature**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-subkey-revocation-signature) (type ID `0x28`) revokes a prior subkey binding signature. +- A [**certification revocation**](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-12.html#name-certification-revocation-si) (type ID `0x30`) revokes a certification signature. -Typical use-cases for revocations are marking certificates or individual subkeys as unusable (for example, when the private key has been compromised or superseded), or marking User IDs as no longer used. +Common scenarios for using revocations include marking certificates or individual subkeys as unusable (e.g., when the private key has been compromised or replaced) or declaring User IDs as no longer valid. ```{note} -OpenPGP certificates act as append-only data structures, in practice. Elements of a certiciate can not be removed from the copies on key servers and the OpenPGP systems of third parties, once published. Implementations usually merge all available components and signatures. +OpenPGP certificates act as append-only data structures in practice. Once elements of a certificate are published, they cannot be removed from key servers or third-party OpenPGP systems. Implementations usually merge all available components and signatures. -Revocations are used as a mechanism to mark components or signatures as invalid. +Revocations are used to mark components or signatures as invalid. ``` Note: certification signatures [can be made irrevocable](https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-10.html#name-revocable).