Can't check signature, DSA key 9C973C92 requires a 256 bit or larger hash
dshaw at jabberwocky.com
Mon Mar 17 16:14:55 CET 2014
On Mar 15, 2014, at 3:53 PM, Juha Heljoranta <juha.heljoranta at iki.fi> wrote:
> I am not able to get the gpg to verify a signature.
> Any advice how to fix this?
> Or could the key 9C973C92 be invalid/broken?
The key may be fine, but the signature is invalid. DSA keys specify how many bits of hash are necessary to make a signature. This key says it needs a 256-bit hash:
> gpg: requesting key 9C973C92 from hkp server pgp.mit.edu
> gpg: armor: BEGIN PGP PUBLIC KEY BLOCK
> gpg: armor header: Version: SKS 1.1.4
> gpg: armor header: Comment: Hostname: pgp.mit.edu
> :public key packet:
> version 4, algo 17, created 1330048372, expires 0
> pkey: [2048 bits]
> pkey: [256 bits]
But the signature is strange. It claims to be SHA-1:
> :signature packet: algo 17, keyid 04918EA99C973C92
> version 4, created 1352169028, md5len 0, sigclass 0x00
> digest algo 2, begin of digest 6f 81
But is way too large:
> hashed subpkt 2 len 4 (sig created 2012-11-06)
> subpkt 16 len 8 (issuer key ID 04918EA99C973C92)
> data: [255 bits]
Basically, the signature failed verification because it's mangled somehow. I'm not sure how they managed to create it, but it's broken.
More information about the Gnupg-users