keybase / keybase/client

Getting "Bad subkey: openpgp: invalid data: Subkey wasn't signed; expected a 'binding' signature"

Open
#6,559 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
9.2k
Forks
1.3k
Avg merge
12h 58m
Merged PRs (30d)
56

Description

Seeing this issue when people attempt to ID me (or I attempt to ID myself) using keybase id robison.

My use case is a single PGP master key (0x22B7F4876EF152B2) generated on an offline Yubikey, which in turn generated subkeys for s/e/a on each of two daily-use Yubikeys:

yk0 (master):
sign/cert: 0x22B7F4876EF152B2

yk1:
sign: 0x7E7B2933C1F568A6
encr: 0x4A8C71D6A219D4F7
auth: 0xD95640C7DCD5B8E6

yk2:
sign: 0xBAE1377A3B4F5C60
encr: 0xBE569D18BC2C10F6
auth: 0x3FA14AC48C948EDD

...with the intentions:

  • either of the pubkey sets could be used to reach me
  • either of the pubkey sets could be used for gpg/ssh-agent (with both pubkeys being added to authorized_keys, obviously)
  • the offline master can be used to revoke subkeys in the event of loss

I imagine it has to do with having two subkeys for each of signing/encryption/authentication, and PGP thinking that one of each key type is the older (the ones on yk1), and thus possibly stale. I may be trying to be too clever by half; would appreciate any feedback if I'm doing something that Keybase doesn't explicitly support.

my log id: f262d399c17efda75328951c

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named in the report. Start by reproducing keybase id robison with the listed Yubikey subkeys and use log id f262d399c17efda75328951c to trace the error; done means identifying whether the subkey configuration can be supported or the limitation is clearly established.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.