Penguin
Recent Changes
Note: You are viewing an old revision of this page. View the current version.

An OpenPGP KeyServer run by the PGPCorporation.

Good points

  1. Having a convenient place to lookup current, valid keys is a great

A list of issues includes:

  1. When viewed as a RobotCA the PGPGlobalDirectory is signifcantly weaker than other RobotCAs in that it sends verifications unencrypted and unsigned.
  2. The server strips signatures from keys not registered with it.
  3. The server does not appear to provide any method of viewing signatures on the keys it serves.
  4. The key used to sign keys is not itself viewable through the server.
  5. Signatures and keys published on other key servers do not appear to migrate to the PGPGlobalDirectory, and visa versa.
  6. Server asks users to sign the directory verification key without any independent verification.
  7. Signatures issued by the PGPGlobalDirectory do not use a policy URL.
  8. Older versions of OpenPGP keys (V3 and previous) are not supported.
  9. Access to a single email account given in a uid for a key permits the key to be removed for email addresses in all uids, without contacting the other email addresses.
  10. There appears to be a bug which occurs when a key with multiple uids/emails is replaced with one with a single uid/email which is in turn replaced with the original key. Verification messages are sent to the multiple emails, but only the verification that goes to the email address that was on the single uid/email actually works. The others get a message aobut the verification timing out.
  11. The timing out of verifications is worrying given the message "No further messages regarding the PGP Global Directory will be sent to this email address unless you choose to participate by providing a verification response to this email." That appears in the verification email. It suggests that if the verification email is lost or times out then the email address is effectly barred from using the keyserver there after.
  12. When it believes a key no longer matches an email address PGPGlobalDirectory should issue a revocation for the signature (as well as removing the key).
  13. PGPGlobalDirectory should not multiply sign the same key within a short space of time, as it currently does if a user switches rapidly between two of more keys for an email address. Multiple signing may be acceptable if the current signature is about to expire or has expired (the current signature expiry is set so short it is hard to tell whether this is kicking in already).
  14. PGPGlobalDirectory actively discourages users' self-eductaion about security, PGP and OpenPGP in general.
  15. For an approach that is so keen on expiring keys and signatures, it seems odd that the directory verification key does not have an expiry date set.
  16. It is not clear whether mirroring, syncing or other facilities are going to be avaliable so that institutions concerned about keyserver requests going outside their intranet can establish a local copy, as they can with other keyserver solutions.
  17. Searching for a name requires the exact name. "Stuart A Yeates", "Stuart A. Yeates" and "Stuart Andrew Yeates" are considered unrelated names and there is no way to search using a substring.
  18. The system is unnecessarily incompatible with existing search tools and systems, particularly with respect to searching for keys.

See: https://keyserver-beta.pgp.com/

These guys sent me an email, what do I do?

Stuart, if you please?