Page MenuHome GnuPG - static

Use RECP_FPR subpacket for standalone designated revocations.
Open, NormalPublic

Description

If a designated revocation is importet as a standalone revocation signature, that is without the public key, the import does not work because the wrong key is used. This is no real problem because other implementations (e.g. PGP) require a complete keyblock anyway and thus gpg creates all revocations which a minimal keyblock.

A way to solve this without keeping a separate mapping table in the keybox with allowed revokers to public keys, is to introduce a subpacket for the target key. LibrePGP as well as RFC-9580 specify a Intendend Recipients Fingerprint subpacket with this purpose:

The LibrePGP Key fingerprint of the intended recipient primary key.
If one or more subpackets of this type are included in a signature,
it SHOULD be considered valid only in an encrypted context, where the
key it was encrypted to is one of the indicated primary keys, or one
of their subkeys. This can be used to prevent forwarding a signature
outside of its intended, encrypted context.

Using this subpacket for a revocation signature from a designated revoker should thus be possible and would apply a more useful purpose to this subpacket.