Alice updates her OpenPGP key yearly. Bob updates his copy using:
Mallory ensures that Bob uses her keyserver, which offers her own key, which
- is sharing the 32-bit "short" Key ID with Alice
- is sharing the 64-bit "long" Key ID with Alice
- is sharing the entire 160-bit SHA1 fingerprint with Alice
In which of the 3 cases will Bob download, store or even subsequently use Mallory's key?
- Related: What is an OpenPGP Key ID collision?
- Related: Are there any known collisions of a "long" (64 bit) OpenPGP key ID?
- Related: the gnupg option
- For a practical scenario, consider whether this recommendation would avoid adding malicious keys if