keybase / keybase/keybase-issues
OpenPGP key update notification email refers to the wrong signing device
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
After updating one of my OpenPGP public keys from the command line, I got a confirmation email referring to the wrong device. From the email:
PGP key updated!
You just updated 28A8 F8D3 3491 1B02 55D8 F334 81FD DC30 10CF D9F6.
You performed this action by signing a statement with desktop, […]
However, the device used to sign the update was a different one, as recorded in the proof payload:
"kid": "012089ad5aa5889935f51ebd90b160f96c72a98b4c4db13b1c378b1f170cf158a4810a",
where kid’s value corresponds to the device laptop-uab.
This happened again on a second update. It appears that these emails refer to the device originally used to upload a key, regardless of which one is used to sign an update.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing a command-line OpenPGP public-key update and compare the confirmation email with the signing device recorded in the linked proof payload. Trace how the email selects the device name and verify it uses the device that signed the update, including the second-update case.
Written by the indexing model from the issue text.
Assessment
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100