Re: Keys using SHA-1 in the kernel keyring

Uwe Kleine-König <[email protected]> Mon, 10 Feb 2025 16:57:43 +0100

Newsgroups	org.kernel.linux.keys
Message-ID	<45vdmzvsm775nfgf2lwok3mpfafvrxldxmrwbumopknkk5d4kd@qyioknmsuv2i>

Hello Krzysztof,

On Sun, Feb 09, 2025 at 03:59:21PM +0100, Krzysztof Kozlowski wrote:
> On 07/02/2025 18:09, Uwe Kleine-KÃ¶nig wrote:
> > 	  Error: 305 certificates have at least one issue
> > 
> > This is nearly half of the keyring that still relies on SHA-1. Among
> > them are the keys by Linus Torvalds, Greg Kroah-Hartman, and yourself.
> > 
> > Fixing is as easy as:
> > 
> >        sq key export --cert DE0E66E32F1FDD0902666B96E63EDCA9329DD07E |
> >                 sq cert lint --fix --cert-file=- |
> >                 sq cert import
> 
> 
> It's not that easy, I think. On Ubuntu 24.04 for example sq does not
> have lint. There is sq-keyring-linter, though, behaving I think almost
> the same.

FTR: The versions involved on Ubuntu 24.04 are:

	sq-keyring-linter 1.0.1-1build2
	sq 0.33.0-3

> Reading its manual I have:
> 
> GNUPGHOME=/my/secret/gnupg_home gpg --export-secret-keys FPR |
> sq-keyring-linter --fix | gpg --import
> 
> (I dropped -p from sq-keyring-linter because it should not be needed)
> 
> But for my key - after providing password for export - it produces warning:
> 
> Certificate 1B93437D3B41629B, key C13766E6868B83D7 uses a
> SHA512-protected binding signature, but a SHA-1-protected backsig
> Certificate 1B93437D3B41629B, key: C13766E6868B83D7: Failed to update
> binding signature: Key 1B93437D3B41629B: Unable to decrypt secret key
> material
> 
> 
> 1B93437D3B41629B is the main key ID, C13766E6868B83D7 is subkey.
> 
> I looked for this but not much in the web. Maybe because (from man):
> "This  tool  does not currently support smart cards."
> But the subkey mentioned here in this gnupghome is not on the smartcard.

I think this could best be solved more interactively than via mail.
Would you mind /joining the #sequoia irc channel on OFTC where more
competent people than I am hang around. That would be great to solve,
because I guess you won't be the only one who tries to fix their keys
with an older version of sequoia.

Actually I'd like a recipe with gnupg only for that reason. I think at
least parts of the issues can be fixed with

	gpg --edit-key --expert

and then resigning the affected uids. But I don't have a key with that
issue to test. (If you want to try, please do so on a backup of your
key.)

Thanks for your feedback
Uwe

signature.asc (application/pgp-signature, 488 B)