Menu

#12 incorrect keyid on short length V4 pubkeys

open
nobody
None
5
2013-01-16
2013-01-16
alex
No

Hi guys,

It seems that the keyserver calculates incorrect fingerprints for short-length V4 pubkeys, those having a two byte header that starts with 0x98 Packet Tag, followed by a single length-octet.
OpenPGP Message Format (rfc 4880) prescribes to substitute single '0x98' octet with the two octet sequence '0x99 0x00' before feeding the pubkey packet into SHA1 digest (see section 12.2). Found the bug when failed to retrive a key from keyserver with the same keyid i used for loading the key. But i succeded when forged keyid by hashing the whole unmodified pubkey packet.

Thank you for your job!

Discussion


Log in to post a comment.

MongoDB Logo MongoDB