Re: [tor-bugs] #20396 [Internal Services/Tor Sysadmin Team]: Tor Project crypto signatures will deceive with 32-bit key ids

[Tor Bug Tracker & Wiki]

#20396: Tor Project crypto signatures will deceive with 32-bit key ids
-+-
 Reporter:  chadmiller   |  Owner:  tpa
 Type:  defect   | Status:  closed
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Critical | Resolution:  invalid
 Keywords:   |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by weasel):

 * status:  new => closed
 * resolution:   => invalid


Comment:

 not a sysadmin issue.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

[tor-bugs] #20396 [Internal Services/Tor Sysadmin Team]: Tor Project crypto signatures will deceive with 32-bit key ids

[Tor Bug Tracker & Wiki]

#20396: Tor Project crypto signatures will deceive with 32-bit key ids
-+-
 Reporter:  chadmiller   |  Owner:  tpa
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Internal Services/Tor Sysadmin Team  |Version:
 Severity:  Critical |   Keywords:
Actual Points:   |  Parent ID:
   Points:   |   Reviewer:
  Sponsor:   |
-+-
 This page has key ids that are too short.

 https://www.torproject.org/docs/signing-keys.html.en

 There are people impersonating GPG releasers in keyservers, and relying on
 ability to create keys that collide in lower 32 bits.. For instance, if
 someone takes the Nick key id 0x165733EA, that will fetch these keys from
 keyservers:

 gpg: key 21194EBB165733EA: public key "Nick Mathewson
 " imported
 gpg: key D50624EC165733EA: public key "Nick Mathewson
 " imported

 And someone fake a source download.

 Or Roger's 0x28988BF5 will get

 gpg: key EB5A896A28988BF5: public key "Roger Dingledine "
 imported
 gpg: key 9C01813428988BF5: public key "Roger Dingledine "
 imported

 or 0x19F78451 will get

 gpg: key 468FAE2919F78451: public key "Roger Dingledine "
 imported
 gpg: key C218525819F78451: public key "Roger Dingledine "
 imported


 The signatures page should never list any 32 bit values. Only have full
 fingerprints, or use the 64-bit long ids or longer.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs