Problems verifying signature with autoimported keys

Holger Sesterhenn Holger.Sesterhenn at
Tue Feb 4 21:24:01 CET 2003

Hi folks,

I am playing around with keyservers and the 'auto-key-retrieve' option and
have some problems to understand why a signature should be bad:


userA at client
	enc keyid: 11111111111111111
	sig keyid: 11111111111111000
	local user

userB at internet
	enc keyid: 22222222222222222
	sig keyid: 22222222222222000
	send a signed and encrypted mail to userA
	public key is uploaded to keyserver
	encrypted to self

userC at company
	sig keyid: 33333333333333000
	has signed public key of userB
	this key is imported by userA,
	signed locally and trusted ultimate

GnuPG 1.2.1 on a SuSe 7.3 box, compiled with keyserver supported.
----------output decryption ---------------------
userA at client:~> gpg --keyserver "hkp://a.public.keyserver"\
--keyserver-options "auto-key-retrieve" --status-fd 2\
--decrypt signed-message

[GNUPG:] ENC_TO 11111111111111111 16 0
[GNUPG:] ENC_TO 22222222222222222 16 0
gpg: encrypted with 1024-bit ELG-E key, ID 11111111111, created 2000-06-06
        "userA <userA at client>"
[GNUPG:] NO_SECKEY 222222222222222222
gpg: encrypted with 1024-bit ELG-E key, ID 22222222222, created 2003-02-04
        "userB <userB at internet>"

<the message>

gpg: Signature made Tue Feb  4 19:08:18 2003 CET using DSA key ID 8C574710
[GNUPG:] SIG_ID skATzmEpRldO4qfomtEO27ZoSTg 2003-02-04 1044382098
[GNUPG:] GOODSIG 2222222222222000 userB <userB at internet>
gpg: Good signature from "userB <userB at internet>"
gpg:                 aka "alias userB <userB at somewhere>"
[GNUPG:] VALIDSIG 2222222222222222222000000 2003-02-04 1044382098 0
gpg: WARNING: message was not integrity protected

-------------------------output list-sig ---------------------
userA at client:~> gpg --list-sig --with-colon --fixed-list-mode
uid:u::::::::userA at client:
sig:::17:1111111111111000:1044379131::::userA at client:13x:
sig:::17:11111111111111000:1044379146::::user at client:18x:

uid:f::::::::userB at internet:
sig:::17:3333333333333000:986092522::::userC at company:10x:
sig:::17:2222222222222000:973844196::::userB at internet:13x:
uid:f::::::::userB at somewhere:
sig:::17:33333333333333000:986092517::::userC at company:10x:
sig:::17:22222222222222000:960367629::::userB at internet:13x:
sig:::17:2222222222222000:960300030::::userB at internet:18x:

uid:u::::::::userC at company:
sig:::17:3333333333333000:1024068137::::userC at company:13x:
sig:::17:1111111111111000:1044383617::::userA at client:13l:
uid:u::::::::userC at old-company:
sig:::17:9999999999999000:955521701::::[User id not found]:10x:
sig:::17:3333333333333000:951407044::::userC at company:10x:
sig:::17:11111111111111000:1044383617::::userA at client:13l:

Signature 9999999999999000 is done by a "CA" (a german computer magazine)

Let me explain what I have done:

- created a new keypair for userA
- exported the public key of userA

- imported this key into the keyring of userB
- created a signed and encrypted message with sender userB and recipient
userA, using the encrypt-to <userB> in ./gnupg/options of userB

- userA at client: gpg --decrypt ... (see above)
    -> public key of userB was imported automatically
    -> bad signature message because no trusted signer

OK I understand why

- userA at client: gpg --recv-keys <keyid of userC>
- userA at client: gpg --edit <userC>
    - lsign ultimate
    - trust ultimate

- userA at client: gpg --decrypt ... (see above)
    -> bad signature message


Exit code of gpg is always 0!

Some more explanations: I would like to import some hundred public keys
which are all signed by a "CA" key. Importing, signing and trusting this
"CA" key, the other keys should automatically be valid as recipient keys.

Adding some other "CA" keys and some public/private keyservers and you are
able to send encrypted mail to a big web of trust automatically (your
company with some branches, your resellers e.g.).

It would be great if someone could tell me what I'm doing wrong.

Best Regards,

Holger Sesterhenn

More information about the Gnupg-devel mailing list