Encryption with expired key?

[Werner Koch]

On Mon, 28 Jul 2003 17:34:13 +0100, Geraint Paul Bevan said:

> It appears that the key which I have been unable to import is set to
> never expire (expiry date=0) according to PGP and this appears to be
> confirmed by pgpdump. Gnupg seems to be incorrectly setting the expiry

Lets see.

> Old: Public Key Packet(tag 6)(143 bytes)
> 	Ver 3 - old
> 	Public key creation time - Wed Mar 12 10:54:24 GMT 2003
> 	Valid days - 1095[0 is forever]
> 	Pub alg - RSA Encrypt or Sign(pub 1)
> 	RSA n(1024 bits) - ...
> 	RSA e(17 bits) - ...
> Old: Signature Packet(tag 2)(166 bytes)
> 	Ver 4 - new
> 	Sig type - Signature directly on a key(0x1f).
> 	Pub alg - RSA Encrypt or Sign(pub 1)
> 	Hash alg - MD5(hash 1)
> 	Hashed Sub: key expiration time(sub 9)(4 bytes)
> 		Time - Thu Jan  1 01:18:15 BST 1970

Interesting.  There is a version 4 direct key signature on a v3 key.
That is a valid construct.  We take the expire date from the signature
unless it is newer than the max-expire date as given in a v3 key.  So
we get an expiration shortly after midnight 1970-01-01.  Assuming
gpgdump gets it right (you can use gpg --list-packets to confirm it),
there seems to be a bug in the signature creation:  18m15s expressed in
seconds is 1095; which is the number of valid days form the
signature (the extra one hour is due to DST).

> 	Hashed Sub: signature creation time(sub 2)(4 bytes)
> 		Time - Thu May 22 15:22:03 BST 2003

Hmmm. How can that be?  expiration times are given in seconds or days
after creation time.  This smells like an integer wrap around.

Can you please do it again using gpg --list-packets and show us the
public key and the first signature.




-- 
Werner Koch                                      <wk@gnupg.org>
The GnuPG Experts                                http://g10code.com
Free Software Foundation Europe	                 http://fsfeurope.org