Re: keyids in signatures getting corrupted, GPG and/or Debian problem?

Jason Harris wrote:
> I've just noticed some signatures with their keyids changed to
> 0x0910 in the last two bytes.  Both keys I've noticed this on
> so far have been submitted directly to kjsl from different
> machines/users, and I believe both users use GPG. The "mangled"
> keyids were logged upon reception, which I believe rules out HD
> problems with keyserver.kjsl.com, and the recurring 0x0910 pattern
> in the same spot feels like more than just a coincidence.
> 
> [checks for more anomalies]
> Looking for "0910" in my logs, this pattern appears quite
> popular on Debian (maintainer) keys, and some keys have
> been submitted from other keyservers (including directly
> from SKS) as well.
> 
> One example is 0xBDBFE83, which came into kjsl via HKP, and
> two others are 0xE0442D74 and 0x1CDB0FE3, which came via email
> from SKS servers.  The first key I noticed came in via HKP and
> the bogus subkey binding signature was hard to miss:  0x12F506C8.

My key (keyID 0x4C40410A) has the corruption you describe.  From memory 
and looking at the output of "gpg --list-keys -v", here is some relevant 
history:

     * 2003-12-06 -- I added a new user ID to my key ([email protected]), 
set the new ID as primary, and sent the key to pgp.mit.edu (to be 
merged).  At this time, the corrupt signature appeared on my former 
primary ID ([email protected]).  I believe I was using gnupg 1.2.3.

     * 2004-02-18 -- I think I noticed that my previous setting of the 
primary ID did not take affect (gpg was probably confused by two user 
ID's being marked primary), so I set it again.  Only the 
[email protected] ID got a new signature, which makes sense.  I also 
added another new user ID ([email protected]).  No new corruption.  I 
was using gnupg 1.2.4.

I suspect the bug is (or was) in gnupg.  If 1.2.3 exhibited the problem 
while 1.2.4 did not, and given the short life of 1.2.3, you can piece 
together why Debian developers might have been disproportionately 
affected.  While 1.2.3 probably did not propagate to any major 
distributions, it was automatically fed to the machines of Debian 
developers.

Sorry, I'm not subscribed to gnupg-devel.  Feel free to forward the info.

-John


-- 
http:// if  ile.org/