Order of lookup methods in --auto-key-retrieve
aheinecke at gnupg.org
Mon Jul 1 09:14:00 CEST 2019
On Sunday 30 June 2019 21:36:56 CEST Wiktor Kwapisiewicz via Gnupg-devel
> The code checks first the keyserver and then the WKD domain. I guess
> this is to limit the number of IP-leaking queries and prefer trusted
I do not think that this is really the reason. As we have the fingerprint when
we verify a signature it is more accurate to look for a key with that
fingerprint on the keyserver instead of only matching the sender address with
> I'm wondering if reversing the order (first WKD, then keyserver)
> wouldn't be a better option. The current mechanism is not perfect, so
> that the IP-leaking could still be triggered by attacker by using a
> brand new key (that is not published on keyservers).
I am fully with you. I've complained about this in the past, but It is not so
important to me anymore because in GpgOL I no longer use "auto-key-retrieve"
until I can show the unverified mail while the key is fetched.
For me it is even more important because GpgOL assigns keys that were fetched
through WKD some additional trust (Level 2) by using the key origin, because
the mail domain owner asserted this key. So if you have a key both on the
keyservers and WKD you will get a different trust level if you receive the key
by verifying a mail or if you receive the key by a "locate-key" when entering
the sender address.
I thought we had an issue for that already but I did not find it. So i've
cerated a new one. https://dev.gnupg.org/T4595
GnuPG.com - a brand of g10 Code, the GnuPG experts.
g10 Code GmbH, Erkrath/Germany, AG Wuppertal HRB14459
GF Werner Koch, USt-Id DE215605608, www.g10code.com.
GnuPG e.V., Rochusstr. 44, D-40479 Düsseldorf. VR 11482 Düsseldorf
Vorstand: W.Koch, M.Gollowitzer, A.Heinecke. Mail: board at gnupg.org
Finanzamt D-Altstadt, St-Nr: 103/5923/1779. Tel: +49-2104-4938799
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 228 bytes
Desc: This is a digitally signed message part.
More information about the Gnupg-devel