Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

lkml.org

Post reply on HN
Print view View original

61–70 of 131 posts

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#61

Post by sneak »

d33 wrote: post #35
ajdlinux wrote: post #5

All the fake keys that I've seen mentioned are from the data set at https://evil32.com . It appears a couple of researchers decided, back in 2014, to demonstrate this issue by cloning the entire strong set of the PGP web of trust (not just Linus' key, but basically everyone who uses PGP/GPG for Free Software development - myself included). It would appear that sometime quite recently, someone decided it would be fun…

At this point this is INSANE that GnuPG still defaults to short IDs...

If you think that's crazy, don't look at the KDF it uses to generate a symmetric key from your passphrase. :D

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#62

Post by vidarh »

x1798DE wrote: post #52
dilap wrote: post #17

Earlier quoted context omitted.

It's software, but it seems like some sort of digit-coloring scheme for hashes could make fakes easy to spot by eye. The simplest thing would just be a different color for every character (and and pick very distinct colors for similarly-shpaed characters). Or maybe color groups of 3 digits or something.

If you're using software to display both key ids, why not just use software to compare them?

They may be on different devices, for example. I agree we should use software to compare them whenever possible, but sometimes it is practical to be able to eyeball differences.

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#63

Post by aftbit »

Hi, Eric here, co-creator of evil32. I posted a brief note on our site about this, but here's a little more detail.

I found an old (local) backup of the private keys and used it to generate revocation certificates for each key. Fortunately, there is no way for anyone else to access or regenerate the private keys for this particular clone of the strong set, and I have been very careful with my copy - it is only available on my personal machine, and I have only used it to generate the revocation certificates. I will not use these keys to generate any fake signatures nor to decrypt any messages intended for the original recipients.

We wanted to bring awareness to the dangers of using short key IDs in the 21st century, since that ID is very easy to fake, and most of the contents of the key body are not covered by the signature, so they can be changed at will. However, we feel that the keys uploaded to the public keyserver are, on balance, more of harmful to the usability of the GPG ecosystem than they are helpful in highlighting security flaws.

It's important to realize that anyone could repeat our work pretty easily. While we did not release the scripts that automated cloning the web of trust, the whole process took me less than a week. Cloning a single key is even easier - it could be done with only a few minutes of effort by someone familiar with GPG. The GPG ecosystem needs to develop better defenses to this attack.

Our original talk (and previous work) seems to have convinced people to stop using 32-bit IDs in documentation or on their business cards. However, there is another common and harmful pattern: users who want to email someone discover their key by searching the keyserver for that email, then taking the newest key. This is akin to trust-on-first-use, and opts out completely from the web of trust or any kind of external verification.

Proof of identity: https://keybase.io/aftbit

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#64

Post by mpasternacki »

brians wrote: post #44
ckastner wrote: post #28

Linus' fake key [1], as well as all the others from the random sample I took, have been revoked as of today. [1] http://pgp.mit.edu/pks/lookup?op=vindex&search=0xEA185A5E76E... .

So the evil32 people kept the private keys. That's exciting.

Not necessarily, they might have just generated revokation certs which are separate (so that they can be used in case your private key is lost). Keeping a revokation cert would be a responsible thing to do, just in case something like this happens.

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#65

Post by JulianMorrison »

yarvin9 wrote: post #50
JulianMorrison wrote: post #34

Earlier quoted context omitted.

I think emoji would be hard to compare. A lot of very similar little faces. Is that a wink or a blink or a frown? An example of urbit's rendering of a 128-bit number into textual form is "racmus-mollen-fallyt-linpex--watres-sibbur-modlux-rinmex". While it might be gibberish, it's gibberish that even a screen-reader program could take a swing at, and humans can easily read.

A similar design is Proquint, which IPFS uses: https://www.npmjs.com/package/proquint Proquint (5 letters per 16 bits) is tighter than Urbit's `@p` (6 letters per 16 bits). The Urbit form was designed for synthetic names and restricts itself to phonemes that sound comfortable and natural to English speakers. (Not to say that English should be the universal language, it's actually a terrible language to make everyone…

Proquint example for comparison: "pokak-fijus-zavaz-posuf-bizar-luhuf-kulor-marak".

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#66

Post by okket »

snassar wrote: post #58
okket wrote: post #45

Earlier quoted context omitted.

But for server installations (auto-signing, checking, etc.) you are often directed to GnuPG 1 because "less dependencies". Also "apt install gnupg" / "dnf install gnupg" both give you version 1 on the most recent Ubuntu/Fedora. For desktop usage many prefer GnuPG 2.0, because they fear compatibility issues that the new 2.1 key storage format could have with 3rd party software, and you can't go back (at least this is…

I don't know where people would run three versions at the same time. The information from the GnuPG project is clear: You can run GnuPG 1.x and GnuPG 2.x at the same time, but you should not have GnuPG 2.0 and GnuPG 2.1 installed at the same time, as bad things might happen. What 3rd party software is using the keystorage mechanisms directly? Do you mean how information is output from GnuPG? It sounds like the situat…

> I don't know where people would run three versions at the same time.

Not on the same machine, but server/automatic -> GnuPG 1, desktop 2.0 or 2.1. Also different people may run different versions, even GnuPG 1 on desktop because they are used to. This compatibility mess that seems to persist for while was what I meant why people prefer to use the lowest common denominator in their sigs/cards/slides -> evil32.

> What 3rd party software is using the keystorage mechanisms directly?

Aren't there any? Good, then I misunderstood that argument in the Homebrew debates I read, sorry. That leaves only the fear of automatic upgrading and the inability to downgrade again as a blocker.

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#67

Post by jcranmer »

yarvin9 wrote: post #50
JulianMorrison wrote: post #34

Earlier quoted context omitted.

I think emoji would be hard to compare. A lot of very similar little faces. Is that a wink or a blink or a frown? An example of urbit's rendering of a 128-bit number into textual form is "racmus-mollen-fallyt-linpex--watres-sibbur-modlux-rinmex". While it might be gibberish, it's gibberish that even a screen-reader program could take a swing at, and humans can easily read.

A similar design is Proquint, which IPFS uses: https://www.npmjs.com/package/proquint Proquint (5 letters per 16 bits) is tighter than Urbit's `@p` (6 letters per 16 bits). The Urbit form was designed for synthetic names and restricts itself to phonemes that sound comfortable and natural to English speakers. (Not to say that English should be the universal language, it's actually a terrible language to make everyone…

If you want to make a more universal phoneme-generator, the basic contours of a nearly-universal [1] phonotactics is as follows:

* Strict CV syllable scheme.

* Atonal

* Consonants distinguished only by voiced/voiceless (Chinese, e.g., doesn't do a voicing distinction, but switching to an aspiration distinction would suffice for them)

* 5 vowels: a, e, i, o, u (actual vowel quality may vary; every language that has at least 5 vowels has these 5 vowels) (some languages, particularly indigenous languages in North America, have 3 or 4 vowels, but the intersection yields too few vowels).

* Consonants are harder to inventory. /p/, /t/, /k/, /m/, /n/ are nearly universal, and /b/, /g/, /d/, /s/, /z/ are also quite common. The IPA /j/ (that's the 'y' in 'ya' for English speakers), /w/ (pronounced as you'd think in English) are pretty common semi-vowels. Maybe /l/, /ʃ/, /ʒ/ as well, should you need more consonants.

That gives you 25-75 plausible syllables, depending on how many consonants you go with.

[1] If you go by least common denominator, you end up with maybe 1 vowel and no consonants (there's no consonant phoneme present in every language IIRC).

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#68

Post by AceJohnny2 »

ajdlinux wrote: post #48
okket wrote: post #45

Earlier quoted context omitted.

But for server installations (auto-signing, checking, etc.) you are often directed to GnuPG 1 because "less dependencies". Also "apt install gnupg" / "dnf install gnupg" both give you version 1 on the most recent Ubuntu/Fedora. For desktop usage many prefer GnuPG 2.0, because they fear compatibility issues that the new 2.1 key storage format could have with 3rd party software, and you can't go back (at least this is…

Debian is currently switched to using gpg2 by default.

Debian is in the process of switching to using gpg2 by default.

Here's this week's LWN article about it:

https://lwn.net/SubscriberLink/696561/6392ebc623b794d8/

Note that it's a subscriber-generated link (articles https://lwn.net/subscribe/

Re: Fake Linus Torvalds' Key Found in the Wild, No More Short-IDs

#69

Post by snassar »

okket wrote: post #66
snassar wrote: post #58

Earlier quoted context omitted.

I don't know where people would run three versions at the same time. The information from the GnuPG project is clear: You can run GnuPG 1.x and GnuPG 2.x at the same time, but you should not have GnuPG 2.0 and GnuPG 2.1 installed at the same time, as bad things might happen. What 3rd party software is using the keystorage mechanisms directly? Do you mean how information is output from GnuPG? It sounds like the situat…

> I don't know where people would run three versions at the same time. Not on the same machine, but server/automatic -> GnuPG 1, desktop 2.0 or 2.1. Also different people may run different versions, even GnuPG 1 on desktop because they are used to. This compatibility mess that seems to persist for while was what I meant why people prefer to use the lowest common denominator in their sigs/cards/slides -> evil32. > Wha…

In practice you can use all three versions of GnuPG on three different devices without a particular difference. One problem you might see is if you are using the newer experimental curve-based algorithms on a computer running GnuPG 1.4 and you get blocked, but you really ought not to do that anyway.

As for the downgrading issue:

It used to be you could just copy your .gnupg directory from computer to computer to computer and that's what constituted migrating your PGP keys.

This was also true for moving frmo GnuPG 1.4 to GnuPG 2.x. If you are starting with a new GnuPG keystore from 2.1 you can't just copy .gnupg and use it in a GnuPG 1.4 system, you have to export your public keys, your private keys, and your trustdb (although I am iffy on what this does) and import them on the systems where you are running GnuPG 1.4 or 2.0

I am unaware of any 3rd party software directly accessing the GnuPG keystore, but that doesn't say much.

Post reply on HN