keybase / keybase/keybase-issues
Can't add public key via curl
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
I'm trying to add my PGP public key to my keybase account. I'm used to the gpg workflow though, so I'm not going to use the keybase CLI for now, and I'm definitely too paranoid to let my private key leave my box. So, I opted for the _hardcore mode_ (hehe). That gave me the following API response:
```json
{"status":{"code":202,"desc":"Login required for this resource, you.","name":"BAD_SESSION"}}
```
Full cURL command
```bash
curl \
--data-urlencode sig="`\
echo '{"body":{"key":{"eldest_kid":"0101fa586ecd32495f372471916f637e7dec6981df74f0d15b989304b907a32ce8d20a","fingerprint":"2af723e9dac7ce5cf4f2267c0eb1b0d79186760b","full_hash":"769fdb615bf0af6a70780c4f0ffa3e599cbf70515bfc91c36f40b8dd791de319","host":"keybase.io","key_id":"0eb1b0d79186760b","kid":"0101fa586ecd32495f372471916f637e7dec6981df74f0d15b989304b907a32ce8d20a","uid":"0c54ccb5c1f3b2737d93f94276d78419","username":"radiergummi"},"type":"eldest","version":1},"ctime":1542809509,"expire_in":157680000,"prev":null,"seqno":1,"tag":"signature"}' | \
gpg -u '2af723e9dac7ce5cf4f2267c0eb1b0d79186760b' -a --sign`" \
--data-urlencode type="eldest" \
--data-urlencode session="undefined" \
--data-urlencode csrf_token="lgHZIDBjNTRjY2I1YzFmM2IyNzM3ZDkzZjk0Mjc2ZDc4NDE5zlv1Z3nOAxcEAMDEIPL9HSvw2G+/6y/oIcgAza6CUD5sBaW6DdvhuWJoblJ4" \
--data-urlencode plain_out="1" \
--data-urlencode signing_kid="0101fa586ecd32495f372471916f637e7dec6981df74f0d15b989304b907a32ce8d20a" \
--data-urlencode public_key="-----BEGIN PGP PUBLIC KEY BLOCK-----
mQENBFuorNMBCADVg7ON59ECZp37mrqkt0uFhukszY25+ksve4UBNvuP7FDhywDm
LLLP/1iEBH03TXxmTqYnDz5SmO3IRYHZXA5ln4i68p65WexCH/GdQOLG3FQbRCZE
NyDyT0sv2jVwD1SOB4bO9ox+RrgzIi3fwJMt2Bi8Xz6r2Un92SG2FB+STfJJNbVs
HeZJ70hQ1kJkYVJj/hf/hIfWyryKdCXJayKZxHfQW2XFhRqgz5b+bahv0N8RLiuS
Yu5Z2HhPvTKeYq19qneYVdWUNsISgrnzjkov4WNECKupPxhlNaJBMZ3/sr8oJaEw
LG0aLhnabJGfycHgDrosDPaiEdLSpf5xbrS/ABEBAAG0N01vcml0eiBGcmllZHJp
Y2ggPG1vcml0ei5mcmllZHJpY2hAbWVzc2VuZ2VycGVvcGxlLmNvbT6JAU4EEwEI
ADgWIQQq9yPp2sfOXPTyJnwOsbDXkYZ2CwUCW6is0wIbAwULCQgHAgYVCgkICwIE
FgIDAQIeAQIXgAAKCRAOsbDXkYZ2C9N0B/wNnYNh+4JEp0xTcyGLEKYW7DVUe04C
eZn3qAzD8Fxd1rzshXPE+InAVdjWwNiw/pVxYINlDUMrxyfKHNeoDQMZKo5Y/8iH
Jo5O08FqDxPpkXWUSqEjXIy3J5IE9pbXYnmVNfkDhPM42e2O75WlyO8b4LbXlrKc
S3xI6OLyoJDc1T2+Syx9u2iBIazL9d+Pl0e/RAUwLZGrOHjCOI/QMvNGEOrAaudx
vovBWp/XxF4/Ux+/Yyzd8Fa+C+11lCoYBfDNlWJmXixpFv2WWHbH+4DOVedDOs3h
qEr8/fgLis74l/FSyvn+9uBWc3sPjcvvrqSd6KnCZmJ200W59Ryl0UDpuQENBFuo
rNMBCACdlZAIz+KARfi32FWHdOKRA015CUf4Uekjssoe9HyjEi0Iqt+BOyCElem9
t0HAx96oR5vJfpeBA7mtmTd1V6c7NYdTNr0t5TVIOGJLsMRit5UdGRF337qAWaS4
J97kNj3lf7zJuTJJqsoHQLzd7dKSBWvEHoQMGsz3kec30oNTyIpvNNouk+Vjz/ek
07MsbnU2q9u1Cbbak3a6dDHOeHoXS7QNwFC3Ui/vrTQGjyVRtzI+BXftaGdk8yX9
WtZyLgvD95QHqrLWmtgzcLMPhZ/108Rrk7umgDm4E4alYWml8V8j2HmeWFr/eaQG
Hp227hUkJa9a6msq4eJBKjILTMLzABEBAAGJATYEGAEIACAWIQQq9yPp2sfOXPTy
JnwOsbDXkYZ2CwUCW6is0wIbDAAKCRAOsbDXkYZ2C6/zB/wOom6siFNyPnUeF6SZ
qpYaOHr6H5Bn5TBedcuyWQmoFuQ95f6JdQiI2P2PJROMq2IGvj76trCwfU+aCcrr
7QGWsI1FMBR+c8q8hf3B/FqrYvjs0bT6p0FyVgSLcmlJNqsXLHH03I6+4zslmS3a
bDVYv22feMQNsKNUQVg1LnEeKPJ0HQrdGoTksBbVxHc5k8bWrhYvt0jaudLpkiXH
aAGXciRMWsf0/5NlP1uh66/JeI426x1Yyx4imNRtdtA/E8fRlqmjZyzE4nQ3k2a3
E2E//C/bblTYLIv3HMNbgC4DkITbrqC7qbqMgdNjWZmrHDWT0bWFWK8cEICQ6fEY
6C/4
=atbB
-----END PGP PUBLIC KEY BLOCK-----" \
--data-urlencode is_primary="true" \
--data-urlencode sig_required="true" \
https://keybase.io/_/api/1.0/key/add.json
```
Looking at `--data-urlencode session="undefined"`, I wonder if that's a JS error?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the reported cURL request to https://keybase.io/_/api/1.0/key/add.json, especially the undefined session value and BAD_SESSION response. Trace how the session and CSRF values are produced for this endpoint, then verify that the documented cURL flow can add a public key without exposing a private key.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100