keybase / keybase/keybase-issues
Message signed by revoked subkey still shown as valid
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
It seems like subkey revocation is ignored on keybase. Even if I paste a message by a revoked subkey, it still validates.
Repo steps:
1. gpg --edit-key KEYID
2. addkey (... select sign only, do all prompts)
3. save
4. echo "This is a test message" | gpg -u F99C9B0F --clear > revoked.txt
5. keybase pgp update
6. cat revoked.txt | xclip -sel clip
7. Check that revoked.txt validates on keybase, it does which is good.
8. gpg --edit-key KEYID
9. key 3
10. revkey
11. save
12. keybase pgp update
13. gpg --verify < ~/Temp/revoked.txt
Gives the following:
```
gpg: Signature made Wed 06 Jul 2016 01:50:29 PM IDT using DSA key ID F99C9B0F
gpg: Good signature from "........."
gpg: WARNING: This subkey has been revoked by its owner!
gpg: reason for revocation: Key is no longer used
gpg: revocation comment: Just testing key revocation
```
1. On keybase pasting the same revoked key gives:

Here's a message with a revoked subkey, as an example. It should not validate under gpg, but on the website it currently does:
```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This is a test message
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAld87FoACgkQKOqUQ0PBhYOCrACgtRjmK6tmwMXVienH/2T6jH3N
9+QAn19UI+CxGYw321XxZROVpQ63iApF
=Jx0E
-----END PGP SIGNATURE-----
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the listed gpg revocation flow, then use `keybase pgp update` and paste the provided signed message to compare Keybase with gpg's revoked-subkey warning. Done means a message signed by a revoked subkey is no longer shown as valid on Keybase.
Written by the indexing model from the issue text.
Assessment
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100