just spotted a possible PGP bug...

So at the moment I have 2 PGP keys, the old one that I've been using, and
a new one I'll probably start using literally this week (was waiting for after
a PGP key signing that happened Saturday).  So a number of people sent
me a signed key using 'caff' - which encrypts it to my key.  And they signed
both keys.  First key arrives, I get prompted for my passphrase.  Then the
second key (remember - encrypted to a different key) arrives - and I don't
get prompted and it magically decrypts...

And it only worked because both keys have the same passphrase on them,
and the code only kept one passphrase around.

Is it worth changing the code to keep track of what key a passphrase is
associated with, and re-prompting if it's a different key?

Or does anybody care about the corner case?

_______________________________________________
Exmh-workers mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/exmh-workers

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFPFbCocC3lWbTT17ARAvouAKDe2cEatn7/2VFnvhqmA8TYj1j4AACdG5qP
DH8LUQ7dFq/yn3nwSqMumfc=
=4gYq
-----END PGP SIGNATURE-----