https://bugs.kde.org/show_bug.cgi?id=527332
Bug ID: 527332
Summary: OpenPGP v6 fingerprints truncated to 50 hex characters
by Formatting::prettyID()
Classification: Frameworks and Libraries
Product: libkleo
Version First unspecified
Reported In:
Platform: Other
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
SUMMARY
Libkleo's Formatting::prettyID() truncates 64-character
OpenPGP v6 fingerprints to 50 hexadecimal characters.
RFC 9580 defines 256-bit fingerprints for OpenPGP v6
certificates. Their complete hexadecimal representation
requires 64 characters.
The truncation prevents users from inspecting the complete
fingerprint in KMail's certificate-selection tooltips.
STEPS TO REPRODUCE
1. Make an OpenPGP v6 certificate available through GPGME.
2. Open KMail.
3. Open Settings -> Configure KMail -> Identities.
4. Edit an identity and select the Cryptography tab.
5. Select the OpenPGP signing or encryption certificate.
6. Inspect the certificate's fingerprint tooltip.
ACTUAL RESULT
The displayed fingerprint contains only the first 50
hexadecimal characters, formatted in groups of five.
Example full fingerprint:
0D7A8BE1410CD68EED4845AB487B4B4CFAECD8EBAD1A1166A84230499200EE20
Displayed representation:
0D7A8 BE141 0CD68 EED48 45AB4
87B4B 4CFAE CD8EB AD1A1 166A8
The complete fingerprint remains available through GPGME.
EXPECTED RESULT
Users should be able to inspect the complete 64-character
fingerprint of an OpenPGP v6 certificate.
A shortened representation may be appropriate for compact
UI elements, but the complete fingerprint should be
available in certificate details or tooltips.
SOURCE ANALYSIS
Libkleo 26.08.1:
src/ui/keyselectioncombo.cpp:178
Constructs the tooltip using Formatting::toolTip().
src/utils/formatting.cpp:489
Calls prettyID(primaryFingerprint()).
src/utils/formatting.cpp:1339
Formatting::prettyID() truncates 64-character
fingerprints to 50 characters and groups them
into five-character blocks.
The truncation affects presentation, not the underlying
fingerprint returned by GPGME.
IMPACT
This affects standard RFC 9580 OpenPGP v6 certificates,
independently of their cryptographic algorithms.
It complicates manual certificate identification and
fingerprint comparison, particularly when multiple
certificates share the same user ID.
SUGGESTED RESOLUTION
Ensure that the complete 64-character fingerprint can
be displayed and copied.
Ideally, formatting should support both legacy 40-character
OpenPGP v4 fingerprints and 64-character OpenPGP v6
fingerprints without information loss.
ENVIRONMENT
Fedora 45 KDE
Libkleo 26.08.1
KMail
GPGME with experimental OpenPGP algorithm mappings
Sequoia Chameleon backend
The observed truncation occurs in Libkleo's formatting
code and is independent of the experimental algorithm
mapping.
REFERENCE
RFC 9580, Section 5.5.4.3
https://www.rfc-editor.org/rfc/rfc9580.html
--
You are receiving this mail because:
You are watching all bug changes.
