keybase / keybase/keybase-issues

Bug: Can't overwrite expired public key

Open
#4,075 9 comments 1 reaction 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

I do not store my private key with keybase nor do I ever want to. I also do not desire to have any clients of keybase locally.

# Problem

My public key on keybase is expired. I have extended my key expiration for a year. Keybase blocks me updating my expired key with a new key (exact same key ID). This has been a problem for over 1 year but I am only now reporting it. I searched the issue history and found a similar issue from another user but it is old.

Error message:

```
Error in your post
-------------------

Code: 905
Name: KEY_CORRUPTED
Description: no valid primary key self-signature or key(s) have expired (Signature failure in packet 1: rejecting insecure hash SHA1 (8d8bf0e242d8a068572ebf3ce8f732347257e65f))
```

Keybase should not be trying to verify signatures with an expired key ESPECIALLY if what the user is trying to update is a new (non-expired) version of that same key.

# My user information

Username: https://keybase.io/samrocketman

New public key (click to expand)

---

```
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFM1ryoBEADVJZ5Yu/+Vg/YkQCvVfX9lDXybk7mkug+9sJdu0TAE8wUbcRqz
4ZtLLHcdqlwbzLDwhT0o9RApko0lt10TZXIG5JvTQfottIW5n8HiP3X2ymd4VIND
qs7Wf4fzEY4RKPJYVC/daIX8rJQ5uY3t8vb/0V3IrgXMDIZ66r49Y9X9XcfyioRA
N8nfaVKkEYyv0Hi2tv070fAAEEcNiTLqQnK+22tTeT7Fw3nvUrw5pJNCUjQkTyT2
xoLdu6qwBzV9TDeraAPnTHkRcjD0CXMV+UVkl9AE4RyAbQdmciTgPwRGCXRcxaQG
Q7l0nKIXDxXLzdE5Rt+i9U56ftq/f5yXcvwzgQorJsqZ45V1RYP/57wtdsFUJBoB
O1IxuwLey/HCLDjHTiYWSMYB8t6pUpM2IgPpAUxvGUQOhhZU6jAJsu4FTtGIgpp2
mLc6ArhxIHYsW/bq7JNIsoz0ewsnJp5vQWuq5EpgxIBtCkjW+XsRBfTITnV21YTm
5Ja2wnHtUh5TtToO3M+trPrTxmIiySAHkILgDIOq2/V94ymtepBuzwt11ToZGV+S
B7t++3LAkxwGfh3RDuGu7yd43kqGkKoDgpDfCuAOMW7O3XWcM4pYoMUVpDC9Cp4X
aZpuPpFIxWaUVLQMfD77PAtsck4lRuCcp5A5/zOTI79j/orA7UZf6Rnw/QARAQAB
tCJTYW0gR2xlc2tlIDxzYW0ubXhyYWNlckBnbWFpbC5jb20+iQJVBBMBAgA/Ahsj
BgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgBYhBI2L8OJC2KBoVy6/POj3MjRyV+Zf
BQJhiCwdBQkQM7BzAAoJEOj3MjRyV+ZfH9wP/A/qkvvLAT9BGXmW8LK5HR69OB49
lKhGR/btkMf4ITQMZbaqyIVE2qMrcWe3hlCUMMSmIVSXWbxJCdF2ZVMdJB2+sO7X
8q44dOTiktuyKeF/Zc4vWxNN3pvpJfR4UETcM6ZsqWzIeMA1tIj9z7bdbq3kFB8U
P7Vc+4dJ0/CNSMUfPZiepEKfH6tg3u/Kz++hK9VY/YqZrhsZFBEfFOfyDK/yXXsn
NeE3cCD3Q9Z9IDLueU81zRpplac9grEhLcGhtFUGql81/SCOPn7+JK5MHdWvckLc
fPseBxLRklafUoFjttyBnHinmFHrN68Qd6RYdAy4JmPcwZqzrA8zind2DPkEG/Ns
AixmByGnzHYP9Fr48ZALdLzh7dj++EqXjM5bjcVPlK78Fc4k++e+Yi2kwKxYecYt
Zyhkt0i83oUCFet4lPry7yjRknNV+vd4g6aKMQGHHYLKAS5Q5H7BaTZS5iIwg3Lq
usiGS62JboMjtog/Ue0scsZBVyW8zeRd86AWQbWvwgGK1jhDt+f91v2bgvw/G2VL
wCailoj/vwq4xG6tI/KKDHeQkg2S2QsY2SYobToeLPNboOnpYFBGUdufn+tQo5rC
Z42TaDRZgM4EWVoMfVUBCu9VE6tT24CLY1fOEHw8PKSGwb6qr0BRvANp0AntGUNU
IoxjAcnHDn1tpQNGtB1TYW0gR2xlc2tlIDxzYWc0N0BkcmV4ZWwuZWR1PokCVQQT
AQIAPwIbIwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AWIQSNi/DiQtigaFcuvzzo
9zI0clfmXwUCYYgsIgUJEDOwcwAKCRDo9zI0clfmXw2WD/sHBvMuGwDwMs9PyOhu
NgfLjWOzDCoeniykUbB0rytOK+I3bMUxWgK7bvPCa1cA6zouYMqsxabVPU4ntHWL
TBE0kKoGJzKcFQEnhk3vUKr01W1GBCeRQeNRV/vUXYW5MDA9tvUgGcHUqXvOJ49x
YI5UD3sMeMokuyveoCWhKG3IkOtkfYJNv11oW1ZRS5ogZouWouCxWK/tPueDAgeB
/2qFJmgmrehWXnJZF0qZVQLsk1zIVuYoGc8d/r6SBRCUm2MtiDvYMegvWdIt2mXX
9aqP4bwi/F7XhC9Z348gu7dghKOgxLoDqRYcsVw0CdqHaiPqNYtvCcmZnDg3CSh5
gKv2I9AGOZch6KMsAebbZVx8W9Uv93wYOaKPPP4qpW6FuSUrBXzJ1nvfbe/ZpbqS
DZKeMwlMbh5r5LhY2oY13aUuwwVGt4ZeAhC5S38AEY4C2v/nwkWwAuocg/gzo9fk
zAu+gcEKotVaQ6093zYMHT/1BwzDr8RXjWeVHGJXXyOyKxnfQxUuSWddu/oFe/Fh
cKj9yiyqa5jbBSW4tSTNs83+rVZJDNQMkOF3Q2CuzEMR4Yh0y+WWohkq+PBnOPwy
oNUIaByLI4OaLw6XeQDuhpQXLf68jWZFsRk+f0jdwi5QYWKw0hhPMasCxOKZL/3k
U5yk3RxKO2aELX448YmfTQOmlLQiU2FtIEdsZXNrZSA8c2FtLmdsZXNrZUBkcmV4
ZWwuZWR1PokCVQQTAQIAPwIbIwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AWIQSN
i/DiQtigaFcuvzzo9zI0clfmXwUCYYgsIgUJEDOwcwAKCRDo9zI0clfmX6nID/4m
PnLf/1KwF52f8pRmOyCt2BwA9+vqXGKuqGG0rw4vCCU0dkwMhUwx6px8Zqa65cHm
67iYeJVDx0FEtxw1f/BnMw+0P7pkkOitWgbPbs7Tc1YkUI9MNLumrqEuRgvnbLqT
AIK8nmpkSx0R8B1iZtfxK83PfvwNZQbgqAurAj0kpYB2OdV/NZR/RFvDU2UY7mp0
rNyMDRWF3kD9m8RKx3dEhMTENC5Regx7Qdb80covtLFFeep4pupjTEaABMzh5eLy
hB/uk+VvieTFoPTQdDNnurY9IRikl1HF2JtxtZR2iTIRSNfAlz269WyDREbCJwd1
Ml1mZnnzk0zchK+ZFLMzEbHGTSfasM02ybLiJ735GsOs6u4hoFCUkrQMFTD+z8Lb
A77IjPWVacgEcfduZ3Pg7gmGpK8MZ2G6XYFRovZP6ztnBGv9p1aJj9//XEU/RDh+
jyvqL22ACTyNM5YQKPLhRC3VEHIBaFSl3wnQ7sWDK+GsnHvW3juvFHO6k4EgJl6D
N+6Z0WoROi83ob15bbRaM2D0tQ7xtoRDSzg6Do3F0Rwl0PgcKq0BC9xKXClkC8X/
ZrMlOcb+uPRqw6VwpxK3M5VUlHS2ZGAdycQo+k/vl6pEMJgLOIwHqteJ+504GVp4
iZnJjxapHtU41+KHS4TZaJHhIrpZFmBlweQ6fXsvR7QbU2FtIEdsZXNrZSA8c2Ft
QGdsZXNrZS5uZXQ+iQJVBBMBAgA/AhsjBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIX
gBYhBI2L8OJC2KBoVy6/POj3MjRyV+ZfBQJhiCwiBQkQM7BzAAoJEOj3MjRyV+Zf
Qj0P/0waCEVhfKc9oET/5WvtH/lCsQG8dLRF95wGBn2jkq1ayIQ6DLu/nGHCK/Lr
d7PMrF94SVp9rmWcGmlQRPCIaSgltERLlAYLb+Eg/XN2hsRP+WiyVbXQPGoE5tp6
B42zUi2atq6P0mMrfjQ9yq+YZT2UdI6Yi8MQWsuAyEM5lU4QJvLHk2Ai64oE2CxE
/Prs/0Qdh8gVAgld1b0REbRQgL0ukzMCax70xD4SPlRPA9APYiP92KhsPhlgnOvf
4bdQ9jutGfO1RKc17NgCz9mfdiH+mhIJgtKdsGGjicA8E5jg18cULXBKIauC0zvy
cDOqg9vHGQkm4egqj21xzGI7UjYVlvqE4i8hL3JlGaF91/cQefs7tiYRUGxWi4ZV
5T64gDLWWAYLlVVlCSm2WC4s23T8SKtGpxlupWSq5Dl6gETK0OHwuq6cI+bNCt+8
/VLPedCtLii5s0M+h2bL0hL8XcsR5MPNwDVdJ4cTNkikwrZNokqX6af8XVLr6mCy
d4Jz23g4efbIolCBCcsZWKNcqrDH9yBx3TvChKLO3caMaXxv/H0XVv3g1psyLLSe
4u+tCqkRz2BRGQgFGmwLsWTw0NS0xV6bo0NZ1qkLGrnJILc00u27U+PRaUbpmQC/
bc6ldEE3cTV/GYmP+F43Bchu78F41CmUkG5S5S6WUvtU6/oluQINBFM1ryoBEAC9
3x32lwNASuQz0gz2T8PkDmCtATb0p27VLM1faBd4ArYfYnW8Dc1hqXhq/kSQsMCH
DWPjGTJqC/CJ0zasKKhskigB0Hn6GXA6yiWgXbmNb0dV4fNrlxHVUDvPfpcOk3xu
Vy1A3Bso93CvZQCqZBBRZz0Geimns1DByfuxUsehJN3x6SO+4hpcKCPuis5JlJFc
2/Hv9kXCL+DzYHxII7w2Ci3NXzMKGu6iFxQHI9EujFHAF93E9oOqMxHkKWL+8G9t
71p8U+IZlkce0jnD6xh3o5kjmR6riqFeqh+yH/OyZC/XEFWG8ZAIE/hlBSsE7K0b
pL2wamyeuQgH657gaM8UwrHBRZ3tOR1X8qvp+1tPzpH1eh6kYRK3hOzDlVtWwvxU
odkFfkt5fWKcvIo59UQ7lEJXOVU3QsVy8jWI0OPm5XGnxKTUp/6HrEiM9G7AfoI+
qSFu1QoDi4MUrwhlsH7rS3qdC4wKdlgOqgGqAxdvrN2s2oq2ynB7pYf5rxLugJBu
fr5qlCpBffnkWS8vrx4DT1jLQa6LfRQ00TMf5pmDOejqAD+60d4e8s6uQroiGXix
ar7UJGAuMqddCpRA/XKVJ1Ff2r/nHagjIoFsRQjtEggN/twoOvAW6rdztccYQ/aM
742PFb65jAuR4xFCyCqyGG921kaRdediBZf5xMcBfQARAQABiQI8BBgBAgAmAhsM
FiEEjYvw4kLYoGhXLr886PcyNHJX5l8FAmGILE4FCRAzsKQACgkQ6PcyNHJX5l/h
gRAAlNq4DLu/uwF7pogme8GsljgXj3dAIjJ2l4bompKDTi0itPA2zgoKzOXZ9GeL
KIxrdThWwzYfJ5Mz7UIlW3RHv6MHKaXa8aPJOQr8LlWJBxIoJhdeyzJlLvF1uSNl
u9aCPvBDka4UUgRRpiXjRP4b6FhFkTqWkTVI2xmcFtGnizg5M6LSKKP5Lgef0LuT
yY5gAcZD1GKQ5QCfaeWFFfm9g65NqsAhvTY6IbPTxcKskHyNI9i13T2S+hT1Slx4
D1/IyFuztxucSSlnM4IkI0pRXq5QNCG/LY40NwD1eOtCxMQtjPMqr/+7XgiTizn8
jG7ZhRZoXwhBcIYarHBDWg4r788xbeISGPRYMa387GSZVfAwJpJXDiHa3d8Hj5qx
vVEJoIHbiQe13yhZ7O1imhMkyxrQZcAyZP1DdIGZfL8rSBv7Atax2pdUlajQmaUx
ZVb7nVId+aZ+z3p6NHWA+AQNmfIE6n0mbpKaEnbg1h7oBume6ydM0+0aPKPbl5n7
rSNdgDE7jYbCoAUT29IA6dqEGRJL8VcSS6ITrghPCkLkb4FrNwt9IP/xN0eBwfE+
rUE1BhszV6DJn1/U9mB7gx6e5CJd/wci+5r0GcXfUtMS5MTGblC6CP0Ghz4z/E2G
7++v606PVevdEXUG3IxEgJG0rHU7ZVqELPlHYsblGZtjCSA=
=wZAe
-----END PGP PUBLIC KEY BLOCK-----
```

---

Here's proof that I own the private key via this signed statement.

Signed statement proving I own the GPG private key (click to expand)

---

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

I am Sam Gleske and I certify this is my public key. This certification only
applies to [the following GitHub issue][1]. This signed statement is to prove
I own the public key in question.

My keybase user is [samrocketman][2].

I have temporarily uploaded my public key to a [GitHub repository][3].

My GPG key ID: 8D8BF0E242D8A068572EBF3CE8F732347257E65F

[1]: https://github.com/keybase/keybase-issues/issues/4075
[2]: https://keybase.io/samrocketman
[3]: https://github.com/samrocketman/gpg

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEjYvw4kLYoGhXLr886PcyNHJX5l8FAmGL4qsACgkQ6PcyNHJX
5l8iKBAAj77taVtNrgVt7W8WiIuz9TDfGSKd3fO6OpnklvbV4a0OCtOfY6tkZ/OM
VqOvHqmbSmVIIPUoDSd+r0l3/jyUvIc1Nj7XsUs4/5RzRYV8038UTeRS9XYtnMsm
WbX5je2CpVJHpovgJBVY+CgiYqhqyc0OrSoYXOVSQO0bYOtP5EoQ86prUDvsHYxX
XsFtpVHi6IEYOUZVONH47yQNAhhJBSUtWVxyboDtCY+c3cuyD+1nLZC2Uf8qnhnT
ZMj3NNiiNejU1l0GWtbFreuGPf2zv7g6u5OVSLDUFutTuRWWr68Gp2yjk2q3+SBr
DVbh5eoiUVGV+Pw+9f7v5O7I2M1XO1tMYoRc1yUOLpRcp4n5w4cpr44i/tF4r1L+
B5O1WvA3lux1AEyvULzFXlIjWvPd6D3xObgLLkX0iz2fSmEHNE/1s0q/Nvk2gWk3
YqaeU+cZyXN1JKV3PTfUdUZ7Til0dvBqRAVdAonp5C4QVD4pFhYmq0f7mPjUH8Mr
+E7U1+kT/vmCfwUvaGnWnily74zEIMuzuSmdtsiR2/TxwGjRho4I9RrVMCveIhKy
hxvcssQVK93TW/Rocg3b3Mj2RqAynTsWTxt22tCBUqhSEzsBIBq8xJcouULliNtS
zNRaqpo9l0mkYFf889jEn0u+FT/7er6uZ74Em2fpZkfkSSWI7TI=
=3vW3
-----END PGP SIGNATURE-----
```

---

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the public-key upload path that produces Code 905 and the KEY_CORRUPTED description; the issue does not name a source file, test, or entry point. Done means an extended, non-expired version of an expired key with the same key ID can be uploaded without rejection, while signature validation remains correct.

Written by the indexing model from the issue text.

Assessment

Domain
cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.