8 ms·

This looks more like a fake sub key that someone tried to pollute the public key servers with Does anybody know how that would be possible? I can't understand

This looks more like a fake sub key that someone tried to pollute the public key servers with Does anybody know how that would be possible? I can't understand why a key server would accept a subkey unless it was correctly signed by the primary key. At the moment, all I can think is: 1. Misbehavior on the part of someone running a keyserver. 2. A bug in the keyserver software which isn't really an issue because PGP implementations will just ignore it Has that always been the case? With all widely used PGP implementations? I ask both of the questions because I can't understand why anybody would go to the trouble of doing this unless it supports some kind of attack (which may no longer be viable, but perhaps was at some time in the past).

diafygi 11y ago
The SKS keyserver pool (which keys.gnupg.net alias's to) doesn't do any cryptographic verification, even verifying self-signatures, before upload. The software just checks to see if the format is valid. It's up to the clients to do their own verification, which in this case GPG does perfectly (it doesn't import the invalid subkey since the self-signature is invalid).
- davout 11y ago
  If it's true it's a nice DoS vector
  - deleted 11y ago
    [deleted]
  - lutoma 11y ago
    fwiw this is currently being discussed on the sks mailing list, but the overwhelming opinon seems to be that the current behaviour should stay. https://lists.nongnu.org/archive/html/sks-devel/2015-05/msg00022.html https://lists.nongnu.org/archive/html/sks-devel/2015-05/msg0...