`keybase pgp verify` marks as verified a signature made post-revocation of a key
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
The following signature has been made after having revoked a key, using an old copy:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
-----BEGIN PGP SIGNATURE-----
iQEcBAEBCAAGBQJYvqFyAAoJEIH93DAQz9n2JuUH/A0AUIpaJyTDoxd0CHzumk6T
SST+xfXZwhGfnZbhlFf6IQ0o9U9BFafHGc8UVJJAMbx87As6naCBP+jgUCSxUU0s
NZynJc2e5CAJwfv5I4z2cdKiPGpVNsYi6TMkEWwCftrgzhSWevXSuiuAg9tMQvxn
xFiPIhvmeJ3UE/s5olKSpoRku9AeG+rVOytOBjUIDLsWRi4cZMrqEJTaCTndFJho
qTwSbWXVMvXsPxXzBA3v9nXLDNWfFLeVfaI7/FcicOs1H0ZJwL79U0PDaFhZjOxV
ooDTlD4FBOtEMtl80ZFSZUHmAxkjxU0VbvEJfT1ZFtZR9ZseQSNY5qXolJYOtys=
=b0nK
-----END PGP SIGNATURE-----
GnuPG gives the following warning:
gpg: WARNING: This key has been revoked by its designated revoker!
gpg: This could mean that the signature is forged.
But this is the output for keybase pgp verify:
Signature verified. Signed by 0x221e 19 minutes ago (2017-03-07 13:02:58 +0100 CET).
PGP Fingerprint: 28a8f8d334911b0255d8f33481fddc3010cfd9f6.
Keybase version: 1.0.18-20170306170025+9d4a393.
See also keybase/keybase-issues#2346.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the provided signed message with keybase pgp verify and compare its result with GnuPG's revocation warning. Trace the PGP verification entry point to determine how post-revocation signatures are handled; done means the command no longer reports this signature as simply verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100