Trust assignment fails for key with fingerprint ending in multiple zero blocks

To Damon damon.tu at outlook.com
Thu Jun 5 11:24:22 CEST 2025


When a GPG key has a fingerprint or keyID that ends with a long sequence of zero bytes (e.g., 0000 0000 0000), GnuPG fails to assign trust to the key and reports an error when running `gpg --check-trustdb` or using the key in Git signature verification.

This appears to be a bug in the `keyid_from_fingerprint` function or in trust database resolution for such edge-case keyIDs.

GnuPG version:
> gpg --version
gpg (GnuPG) 2.4.7
libgcrypt 1.11.1
Copyright (C) 2024 g10 Code GmbH
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/user/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

> git verify-commit -v abcedfg
ggpg: Signature made Sat 31 May 2025 10:23:03 AM CST
gpg: using EDDSA key FFFFD546BAF8A3B1F7805F30100C999999999999
gpg: DBG: Oops: keyid_from_fingerprint: no pubkey; fpr: ffffe32f62fa6745c5cb09c2412a0000
gpg: Good signature from "Damon To <xxx at xxxx.xxx>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: FFFF E32F 62FA 6745 C5CB 09C2 412A 0000 0000 0000
Subkey fingerprint: FFFF D546 BAF8 A3B1 F780 5F30 100C 9999 9999 9999


> gpg --list-secret-keys --keyid-format=long --with-keygrip
gpg: DBG: Oops: keyid_from_fingerprint: no pubkey; fpr: ffffe32f62fa6745c5cb09c2412a0000


You can use the following secret key to reproduce this issue.

6B33500000000000.asc

-----BEGIN PGP PRIVATE KEY BLOCK-----
lDsEZrxltRYJKwYBBAHaRw8BAQdA5YAyQLyr+9iU0vxkNHhZGprv18KrI8tPxWep
p4vH2W//AGUAR05VAbQGTk9OQU1F
=oFN7
-----END PGP PRIVATE KEY BLOCK-----




More information about the Gnupg-users mailing list