Key privacy settings

On a traditional key server, everyone can upload any key they like, including all signatures on that key. Some people don’t like it when everyone can see who has signed their key, as this might reveal sensitive information about social connections. This has the effect that among people where privacy is important, key servers are often not used, which decreases security as it gets more difficult to spread new signatures, which is particularly important for revocation signatures. On gnewpg, newly uploaded keys are automatically marked as private, which means that only people who already posess the key will be able to receive new signatures for it. People can prove that they posess a key by uploading it. The privacy settings of a key can be changed by its verified owner.

When a registered user uploads a key, the key will be added to the keyring of their user account. This enables them to receive updates for the key without having to upload it every time. Also, each user gets a personal keyserver URL, which they can use in their local PGP application to access not only keys that are public, but also non-public keys in the keyring of their user-account.

Security information about keys

Traditional key servers only list keys, but they do not show any information about their trustworthiness. Only after downloading a key from a key server you can see in your local PGP application whether the key can be trusted. gnewpg tries to give as detailed information as possible about whether a key can be trusted, by analysing the security of the algorithms used and by verifying the names and e-mail addresses used in keys.

Groups

You can create groups of keys on gnewpg. Each group is accessed by a specific URL, and everyone who posesses this URL can access the group. Depending on what settings the creator of the group makes, either everyone or only specific people can add keys to the group. You can for example create a group for your organisation and give its URL to all members. This way, all members of your organisation can see the keys of all other members, without those keys having to be visible to the whole world.