Re: [Sks-devel] Interesting key merging bug with searching

[David Shaw]

Good point.  I see this on the PKS servers as well.  Here's an example
of two different keys with colliding short key IDs sharing user IDs:

http://keyserver.kjsl.com:11371/pks/lookup?op=vindex&fingerprint=on&search=0x1EFFBA41

Been a while since I looked at the pksd code, but I would certainly
believe it could do this.  It seems that this only happens if the key
parameters are in common: I can't find a case where, for example, a
DSA and RSA key were merged.

David

On Sun, Nov 06, 2005 at 10:49:57PM -0500, Yaron Minsky wrote:
> I can't see offhand how this would show up as a result of a bug in the
> search mechanism: the word searches are indexed by full key hashes, and so
> the word search should pull up the correct answer. But what it actually
> looks like is that the keys of these people have been inadvetantly merged. I
> have no reason to think offhand that the merging was done by SKS. SKS only
> merges keys when the public key packet is identical, not merely when the
> keyids match. But some other piece of software could have done this and fed
> it to SKS, which would then propagate it happily. Does this show up only in
> the SKS servers, or do other servers have the same bad key?
> 
> y
> 
> On 11/6/05, David Shaw <address@hidden> wrote:
> >
> > This was originally reported as a GnuPG bug, but it seems that SKS is
> > actually making the odd response here.
> >
> > Basically there are two keys, both with key ID A56E15A3 (a natural
> > collision). One has various user IDs indicating ownership by "Hubert
> > Figuiere". The other one has a user ID for "Pedro R. Fernandez". If
> > you search for "Figuiere" in SKS, you get both keys, and the user IDs
> > are joined so each key has IDs from the other.
> >
> > $ curl '
> > http://keyserver.ubuntu.com:11371/pks/lookup?op=index&options=mr&search=Figuiere
> > '
> > info:1:2
> > pub:A56E15A3:17:1024:1012389324::
> > uid:Hubert Figuiere <address@hidden>:1119055887::
> > uid:Hubert Figuiere <address@hidden>:1130648607::
> > uid:Hubert Figuiere <address@hidden>:1028015454::
> > uid:Hubert Figuiere <address@hidden>:1130648605::
> > uid:Pedro R. Fernandez (GNU/Linux User #000.204.555
> > http%3A//counter.li.org/) <address@hidden>:::
> > pub:A56E15A3:17:1024:1002062559::
> > uid:Hubert Figuiere <address@hidden>:::
> > uid:Hubert Figuiere <address@hidden>:::
> > uid:Pedro R. Fernandez (GNU/Linux User #000.204.555
> > http%3A//counter.li.org/) <address@hidden>:1002062559::
> >
> > David
> >
> >
> > _______________________________________________
> > Sks-devel mailing list
> > address@hidden
> > http://lists.nongnu.org/mailman/listinfo/sks-devel
> >

> _______________________________________________
> Sks-devel mailing list
> address@hidden
> http://lists.nongnu.org/mailman/listinfo/sks-devel