Revisions to Shouldn't GPG key fetching use a secure connection?

edited tags

Link

edited Oct 1, 2013 at 17:11

Thomas Pornin

328.6k
60
800
969

edited tags

Link

edited Jun 5, 2011 at 11:23

AviD ♦

73.6k
24
141
222

cryptography key-management pgp

added 381 characters in body

Source Link

edited Jun 3, 2011 at 7:06

LanceBaynes

6.3k
12
63
93

If I run this for example:

gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451

then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) Could it be compromised because the key fetching doesn't use end-to-end encryption+proper authentication (MITM attack)?

UPDATE: So I'm asking exactly this: when I want to grab someone's public GPG, then could it be attacked with MITM? (So that the attacker hijacks the "connection" and it spoofes the keyserver.ubuntu.com to an ip that he ownes, and gives a false public key, and when I check it with GPG then I will contact the bad GPG keyserver, and it could look like that the GPG key is valid!)

If I run this for example:

gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451

then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) Could it be compromised because the key fetching doesn't use end-to-end encryption+proper authentication (MITM attack)?

If I run this for example:

gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451

then does the importing occur in a secure way? I mean does it go over only secured connections? (HKP?) Could it be compromised because the key fetching doesn't use end-to-end encryption+proper authentication (MITM attack)?

UPDATE: So I'm asking exactly this: when I want to grab someone's public GPG, then could it be attacked with MITM? (So that the attacker hijacks the "connection" and it spoofes the keyserver.ubuntu.com to an ip that he ownes, and gives a false public key, and when I check it with GPG then I will contact the bad GPG keyserver, and it could look like that the GPG key is valid!)