subkey binding signature with no usage flags
Daniel Kahn Gillmor
dkg at fifthhorseman.net
Sat Sep 14 18:45:13 CEST 2013
On 09/14/2013 12:26 PM, Robert J. Hansen wrote:
> On 9/14/2013 11:44 AM, Daniel Kahn Gillmor wrote:
>> This is a security vulnerability because it exposes messages that
>> should be confidential to decryption by keys that are not intended or
>> designated for that purpose.
> You have not discovered a security vulnerability in either GnuPG or SKS.
The issue under discussion in this thread has nothing to do with SKS.
> You have discovered that users who are not as clever as they think can
> use the --expert flag to do foolish things, and that some of these
> foolish things have consequences attached.
This also has nothing to do with gnupg's --expert flag. Neither stable
branch of GnuPG can in its current form generate keys with all the usage
flags set to zero.
This is about interoperability with other OpenPGP implementations
(including possible future versions of GnuPG, but that's a separate
issue) that may include the ability to set an all-zero key flags
subpacket in their subkey binding signatures.
> To this, all I can say is I hope the GnuPG developers triage this as
> NOTABUG and WONTFIX.
This bug is already fixed in the master branch. Are you suggesting that
the fix should be reverted?
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 1027 bytes
Desc: OpenPGP digital signature
More information about the Gnupg-devel