Your message dated Sat, 09 Sep 2017 12:06:38 -0400
with message-id <[email protected]>
and subject line Re: [pkg-gnupg-maint] Bug#659905: Short key collisions
has caused the Debian Bug report #659905,
regarding gnupg: --recv-keys downloads the demanded keys plus another one
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
659905: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659905
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: gnupg
Version: 1.4.11-3
Severity: normal
File: /usr/bin/gpg
Usertags: pca.it-communication
Hi there!
I was importing some keys after the FOSDEM 2012 Keysigning Party and
here a strange result:
=====
$ gpg --recv-keys 171CAA4A 613F3AE4
gpg: requesting key 171CAA4A from hkp server keys.indymedia.org
gpg: requesting key 613F3AE4 from hkp server keys.indymedia.org
gpg: key BC2914B4171CAA4A: "NAME SURNAME <EMAIL>" 92 new signatures
gpg: key A01C807C1C8BB5A7: "NAME SURNAME <EMAIL>" not changed
gpg: read_block: read error: invalid packet
gpg: public key 0EBD65E13C093EEF is 29789 seconds newer than the signature
gpg: public key 0EBD65E13C093EEF is 29789 seconds newer than the signature
gpg: public key 0EBD65E13C093EEF is 29789 seconds newer than the signature
gpg: no ultimately trusted keys found
gpg: Total number processed: 2
gpg: unchanged: 1
gpg: new signatures: 92
gpg: keyserver timed out
gpg: keyserver receive failed: keyserver error
$ gpg --recv-keys 171CAA4A 613F3AE4
gpg: requesting key 171CAA4A from hkp server keys.indymedia.org
gpg: requesting key 613F3AE4 from hkp server keys.indymedia.org
gpg: key BC2914B4171CAA4A: "NAME SURNAME <EMAIL>" not changed
gpg: key A01C807C1C8BB5A7: "NAME SURNAME <EMAIL>" not changed
gpg: key 758FA22A613F3AE4: "NAME SURNAME <EMAIL>" 204 new signatures
gpg: public key 0EBD65E13C093EEF is 29789 seconds newer than the signature
gpg: public key 0EBD65E13C093EEF is 29789 seconds newer than the signature
gpg: public key 0EBD65E13C093EEF is 29789 seconds newer than the signature
gpg: no ultimately trusted keys found
gpg: Total number processed: 3
gpg: unchanged: 2
gpg: new signatures: 204
$ gpg --keyserver keys.gnupg.net --recv-keys 171CAA4A 613F3AE4
gpg: requesting key 171CAA4A from hkp server keys.gnupg.net
gpg: requesting key 613F3AE4 from hkp server keys.gnupg.net
gpg: key BC2914B4171CAA4A: "NAME SURNAME <EMAIL>" not changed
gpg: key A01C807C1C8BB5A7: "NAME SURNAME <EMAIL>" not changed
gpg: key 758FA22A613F3AE4: "NAME SURNAME <EMAIL>" not changed
gpg: Total number processed: 3
gpg: unchanged: 3
=====
Let me see if I wrote something strange on the command line, so let me
rewrite everything:
=====
$ gpg --recv-keys 171CAA4A
gpg: requesting key 171CAA4A from hkp server keys.indymedia.org
gpg: no valid OpenPGP data found.
gpg: key BC2914B4171CAA4A: "NAME SURNAME <EMAIL>" 1 new signature
gpg: public key 0EBD65E13C093EEF is 29789 seconds newer than the signature
gpg: public key 0EBD65E13C093EEF is 29789 seconds newer than the signature
gpg: public key 0EBD65E13C093EEF is 29789 seconds newer than the signature
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg: new signatures: 1
gpg: keyserver timed out
gpg: keyserver receive failed: keyserver error
$ gpg --recv-keys 171CAA4A 613F3AE4
gpg: requesting key 171CAA4A from hkp server keys.indymedia.org
gpg: requesting key 613F3AE4 from hkp server keys.indymedia.org
gpg: key BC2914B4171CAA4A: "NAME SURNAME <EMAIL>" not changed
gpg: key A01C807C1C8BB5A7: "NAME SURNAME <EMAIL>" not changed
gpg: key 758FA22A613F3AE4: "NAME SURNAME <EMAIL>" not changed
gpg: Total number processed: 3
gpg: unchanged: 3
$ gpg --recv-keys 613F3AE4
gpg: requesting key 613F3AE4 from hkp server keys.indymedia.org
gpg: key 758FA22A613F3AE4: "NAME SURNAME <EMAIL>" not changed
gpg: Total number processed: 1
gpg: unchanged: 1
$ gpg --recv-keys 613F3AE4 171CAA4A
gpg: requesting key 613F3AE4 from hkp server keys.indymedia.org
gpg: requesting key 171CAA4A from hkp server keys.indymedia.org
gpg: key 758FA22A613F3AE4: "NAME SURNAME <EMAIL>" not changed
gpg: key BC2914B4171CAA4A: "NAME SURNAME <EMAIL>" not changed
gpg: key A01C807C1C8BB5A7: "NAME SURNAME <EMAIL>" not changed
gpg: Total number processed: 3
gpg: unchanged: 3
=====
Please note that this bug is not linked to the keyid-format I chose:
=====
$ grep keyid ~/.gnupg/gpg.conf
keyid-format long
$ gpg --keyid-format short --recv-keys 613F3AE4 171CAA4A
gpg: requesting key 613F3AE4 from hkp server keys.indymedia.org
gpg: requesting key 171CAA4A from hkp server keys.indymedia.org
gpg: key 613F3AE4: "NAME SURNAME <EMAIL>" not changed
gpg: key 171CAA4A: "NAME SURNAME <EMAIL>" not changed
gpg: key 1C8BB5A7: "NAME SURNAME <EMAIL>" not changed
gpg: Total number processed: 3
gpg: unchanged: 3
=====
Thx, bye,
Gismo / Luca
-- System Information:
Debian Release: wheezy/sid
APT prefers unstable
APT policy: (990, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages gnupg depends on:
ii dpkg 1.16.1.2
ii gpgv 1.4.11-3
ii install-info 4.13a.dfsg.1-8
ii libbz2-1.0 1.0.6-1
ii libc6 2.13-24
ii libreadline6 6.2-8
ii libusb-0.1-4 2:0.1.12-20
ii zlib1g 1:1.2.3.4.dfsg-3
Versions of packages gnupg recommends:
ii gnupg-curl 1.4.11-3
ii libldap-2.4-2 2.4.28-1.1
Versions of packages gnupg suggests:
ii gnupg-doc <none>
ii imagemagick 8:6.6.9.7-5+b2
ii libpcsclite1 1.8.2-1
-- no debconf information
pgpQ8VN8wpEhk.pgp
Description: PGP signature
--- End Message ---
--- Begin Message ---
On Sat 2017-09-09 17:02:31 +0200, Elena ``of Valhalla'' wrote:
> This ticket has remained open for a few years; nowadays short-ids are
> getting more and more deprecated, with the interfaces moving forwards
> towards using long-ids and full fingerprint.
>
> Could the bug be closed as no longer really relevant in the way gnupg
> should be currently used?
I confess i don't even see what the original bug report is complaining
about. The user asks for all keys that have the given short key IDs
and, sure enough, they get a bunch of certificates that contain those
short key IDs in them. :/
today, those two short key IDs result in 5 certs being retrieved (because
of evil32, i think) instead of the original 3.
>> I find strange that when I ask for a key what is returned is actually a
>> *master* key as well as all the possible *subkeys*. This obviously
>> means that the possibility of a collision is bigger.
>
> Personally I find it convienent to be able to download a key by giving
> the id of a subkey as that is what is displayed e.g. by mutt when an
> email is signed by an unavailable key.
Yup, agreed. I'm closing this bug because i think GnuPG is doing what
the user asked it to do. If the user wants a specific key, they should
use a more specific key ID (at least long key ID, preferably full
fingerprint).
Thanks for triaging this bug, Elena!
If anyone disagrees with this conclusion, feel free to reopen the bug
report and explain the problem more clearly so we know what you think
the right behavior should be in this situation.
thanks,
--dkg
signature.asc
Description: PGP signature
--- End Message ---
