Alice updates her OpenPGP key yearly. Bob updates his copy using: gpg2 --refresh-keys

Mallory ensures that Bob uses her keyserver, which offers her own key, which

  1. is sharing the 32-bit "short" Key ID with Alice
  2. is sharing the 64-bit "long" Key ID with Alice
  3. is sharing the entire 160-bit SHA1 fingerprint with Alice

In which of the 3 cases will Bob download, store or even subsequently use Mallory's key?

  • Are you aware of the difference between collisions and preimages? – forest Mar 30 '19 at 1:10
  • Yes. If you are worried about someone creating two keys, one malicious and one not, just so they can trigger a fingerprint collision later, then there is a risk. If you are worried about someone not involved in creating the original key finding a preimage to impersonate the original key, you have much, much less to worry about. – forest Mar 30 '19 at 9:21
  • What do you mean by discarding unrelated data? – forest Mar 30 '19 at 22:48
  • I expect that there is no risk whatsoever that gnupg will import a different key that merely matched in (partial) fingerprint. I am definitely misunderstanding something if this risk changes based on the method of obtaining such. – anx Mar 30 '19 at 23:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.