noqtis-revoke(1)

NAME

noqtis-revoke — say that a seal key must no longer be trusted

SYNOPSIS

noqtis revoke -k key [-p key.pub] [--at time] [--reason text] [-o file] [-f]

DESCRIPTION

noqtis revoke writes a key statement (‘noqtis-keys-1, noqtis-capsule(5)’), signed by key, that it is revoked from time, for instance because it may have been copied. noqtis-check(1) --keys file then accepts a capsule sealed with key only when a verified timestamp (--anchor) shows that it was sealed before time: the manifest's ‘created’ is the sealer's own word, and a thief holding the key could write any. Make the statement while you still hold the key, and keep a copy apart from it.

-k key, --key=key: The secret key being revoked.
-p key.pub, --pub=key.pub: Its public key. Default: key.pub.
--at time: When the revocation takes effect, as ‘YYYY-MM-DDTHH:MM:SSZ’ (UTC, 1970 or later). Default: now.
--reason text: Up to 255 bytes of text, kept in the statement.
-o file, --out=file: Write the statement to file instead of standard output.
-f, --force: Replace file if it exists.

EXIT STATUS

0: The statement was written.
2: A usage error, a key file that cannot be read, a key that is not a post-quantum signature key pair, or a file that cannot be written.

EXAMPLES

$ noqtis revoke -k me --reason "laptop lost" -o me.revoked
$ noqtis check -p me.pub --anchor tsa-root.der --keys me.revoked results