keybase / keybase/keybase-issues

Keybase asks me to sign my updated public key for no apparent reason

Open
#3,026 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

Hello,

I would like to update my GPG public key on keybase, to replace the current key (which is expired) with a more recent version of the same key. To do this, I can select "Update my key (I edited it elsewhere)", and then paste the new key. However, the Keybase website now asks me "How would you like to sign your updated public key? You'll do this using your private key." and gives me several options to do this.

I don't understand why it is necessary for me to perform a new signature when uploading a new version of my existing key. As far as I understand, only someone with my private key can create a new version of the public key, and the updated public key already carries the self-signature made by GPG when editing the key.

Hence, in my opinion it is a problem that additional user action is required when uploading a new version of an existing key. In fact, Keybase should be able to automatically update its public keys from keyservers without any user action.

If I don't properly understand what is going on, and if this signature is actually required for a good reason, the prompt "How would you like to sign your updated public key?" should give more information about why this action is needed.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the Keybase website flow for “Update my key (I edited it elsewhere)” with an expired key and review why it presents the signing prompt. Done means either the unnecessary action is removed or the prompt clearly explains why the signature is required, with the chosen behavior confirmed against the issue’s GPG assumptions.

Written by the indexing model from the issue text.

Assessment

Domain
cryptography, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.