Home / ubuntu / Questions / 817779
Accepted
showkey
Asked: 2016-08-29 04:01:06 +0800 CST

Are all OpenPGP public key server equal?

  • 772

An error info occur when to execute apt-get update .

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used.

GPG error: http://download.virtualbox.org jessie InRelease: The following
signatures couldn't be verified because the public key is not available: 
NO_PUBKEY A2F683C52980AECF

I found an answer:

gpg --keyserver  key_server_name  --recv-keys  A2F683C52980AECF
gpg --armor --export A2F683C52980AECF| apt-key add -

There are two pool.sks-keyservers.net and keys.gnupg.net among many public key servers, are they equal?

gpg --keyserver  pool.sks-keyservers.net  --recv-keys  A2F683C52980AECF
gpg --keyserver  keys.gnupg.net  --recv-keys  A2F683C52980AECF

Do the two commands take same effect?

gnupg

3 Answers

  1. Best Answer

    Most OpenPGP key servers are integrated in the SKS key server pool and exchange keys among each other. You can have a look at the pool status pages to get an overview of the contained servers. pool.sks-keysevers.net resolves to a (weighted) random choice of those servers.

    Actually, keys.gnupg.net is a simple alias for pool.sks-keyservers.net (technically speaking, a CNAME to this domain):

    $ host keys.gnupg.net
keys.gnupg.net is an alias for pool.sks-keyservers.net.
[...]

    In the end, it does not matter which server you choose, as long as it is contained in the pool. Using pool.sks-keyservers.net is a safe choice, and keys.gnupg.net is equivalent.

    A typical answer of a key server that is not synchronizing is the PGP Global Directory, which also performs a simple ownership verification of the mail addresses contained.

    • 13

  2. Key servers exchange keys. That is why it does not matter which server to use.

    • 2

  3. There's now also keys.openpgp.org which deliberately is NOT part of the SKS server pool:

    Is this server part of the "SKS" pool?

    No. The federation model of the SKS pool has various problems in terms of reliability, abuse-resistance, privacy, and usability. We might do something similar to it, but keys.openpgp.org will never be part of the SKS pool itself.

    See also this blog post for more background.

    • 2