4 ms·
Still have to trust 1k RSA keys because GPG does not allow us to say they're unsafe.
by julian-klode 5y ago
Still have to trust 1k RSA keys because GPG does not allow us to say they're unsafe.
- deknos 5y agoi am pretty sure you can mark them yourself. but that they are generally still used, well that's called backwards compatibility. and that's needed.
- upofadown 5y agoYou can tell how long a key is just by looking at it. You can then say anything you want. The use of particular keys is a Debian policy issue. It has nothing to do with the use of a particular message format like OpenPGP.
- julian-klode 5y agoThat's not how it works, no. This is a gpg specific issue as it does not communicate the key size over the status fd. We don't parse the keys ourselves for obvious reasons.
- upofadown 5y agoDunno about that but --with-colons certainly works to show the key length of a key.