duplicate keyid survey results

[David Shaw]

On Sat, Mar 09, 2002 at 03:39:44PM +0900, Hironobu SUZUKI wrote:
> 
> > It is easy to make even a duplicate 64-bit keyid. 
> 
>  Step 0: If you use 32bit keyid, move Step 1. If 64bit keyid, move 
> 	 Step 2.
> 
>  Step 1: If you try to get a key by 32bit keyid but found duplicate keys,
> 	 move Step 2 or Step 3 which you wish.
> 
>  Step 2: If you try to get a key by 64bit keyid but found duplicate
>          keys, move Step 3 or Step 4 which you wish.
> 
>          If 32bit duplicate keyid was generated by accidentally, 
> 	 64bit keyid searching will help most of them. 
> 
>  Step 3: Use Web interface and check a list of keyids combined
>          fingerprints. Select one key and database will return actual
>          key (using database OID). Users must be patients. So, some
>          people like me move to Step 4.
> 
>  Step 4: Ask an actual public key for the key owner or get an public
>          key from owner's web page.

This is an algorithm that a human being can follow.  What is a program
supposed to do?  Most people do not use a web interface to get their
keys - they use the keyserver interface in their application, which
can only say "give me 0xXXXXXXXX".  It should not have to parse and
understand lots of HTML to try and resolve conflicts.  Also, PGP is
not being updated anymore.  Even if code is added to GnuPG to talk to
your keyserver, PGP will not be able to.

Let me try and approach this from another direction: do you see any
security problem with returning more than one key with the same keyid?
If yes, can you tell me why?

Remember that the keyserver does nothing to validate the keys - that
is the job of the signatures on the key.  The decision on whether to
use a particular key belongs to the *user* who verifies the signatures
and decides where this key fits into the web of trust.  One of the
main reasons for key signatures in the first place is to deal with
this exact problem.  There can never be a denial of service by
generating a fake key with the same keyid because of the signatures.

David

-- 
   David Shaw  |  dshaw@jabberwocky.com  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson