Checking key server response against the request parameters

Stefan Tomanek tomanek at internet-sicherheit.de
Sun Sep 15 23:22:50 CEST 2013


Dies schrieb Stefan Tomanek (tomanek at internet-sicherheit.de):

> While working with the gnupg source code, I noticed that gnupg does not take
> the query itself into consideration when retrieving key data from a server
> (--search-key, --recv-key); regardless of the query issued, gnupg will happily
> import anything returned.

I just noticed that gnupg will even import secret keys from any keyserver
response if the key data is prefixed with "BEGIN PGP PUBLIC KEY DATA".
My newly submitted patch (v2) fixes this issue as well.

Any feedback is welcome :-)
-- 
if(is) - Institut für Internet-Sicherheit
Westfälische Hochschule, Gelsenkirchen
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 828 bytes
Desc: Digital signature
URL: </pipermail/attachments/20130915/246ea77e/attachment.sig>


More information about the Gnupg-devel mailing list