keybase / keybase/keybase-issues

Message signed by revoked subkey still shown as valid

Open
#2,346 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

It seems like subkey revocation is ignored on keybase. Even if I paste a message by a revoked subkey, it still validates.

Repo steps:
1. gpg --edit-key KEYID
2. addkey (... select sign only, do all prompts)
3. save
4. echo "This is a test message" | gpg -u F99C9B0F --clear > revoked.txt
5. keybase pgp update
6. cat revoked.txt | xclip -sel clip
7. Check that revoked.txt validates on keybase, it does which is good.
8. gpg --edit-key KEYID
9. key 3
10. revkey
11. save
12. keybase pgp update
13. gpg --verify < ~/Temp/revoked.txt

Gives the following:

```
gpg: Signature made Wed 06 Jul 2016 01:50:29 PM IDT using DSA key ID F99C9B0F
gpg: Good signature from "........."
gpg: WARNING: This subkey has been revoked by its owner!
gpg: reason for revocation: Key is no longer used
gpg: revocation comment: Just testing key revocation
```
1. On keybase pasting the same revoked key gives:

![selection_128](https://cloud.githubusercontent.com/assets/3147213/16616096/97ef766c-4383-11e6-91dd-76442356786f.png)

Here's a message with a revoked subkey, as an example. It should not validate under gpg, but on the website it currently does:

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is a test message
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAld87FoACgkQKOqUQ0PBhYOCrACgtRjmK6tmwMXVienH/2T6jH3N
9+QAn19UI+CxGYw321XxZROVpQ63iApF
=Jx0E
-----END PGP SIGNATURE-----
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the listed gpg revocation flow, then use `keybase pgp update` and paste the provided signed message to compare Keybase with gpg's revoked-subkey warning. Done means a message signed by a revoked subkey is no longer shown as valid on Keybase.

Written by the indexing model from the issue text.

Assessment

Domain
cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.