Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. GnuPG>
  3. devel
[0.9.0] still problems with trust
roland at spinnaker
Jan 6, 1999, 6:57 AM
Post #1 of 3 (204 views)
Permalink
I still have problems when I check RSA signatures with GPG 0.9.0,
because gpg still tells me that there is no trusted signature, while
there is one.

One example:
I got a mail from TC TrustCenter and mutt/gpg shows me the following
output (manually line wrap):

gpg: Signature made Wed Jan 6 12:03:41 1999 CET using RSA key ID BA523901
gpg: Good signature from "TC TrustCenter, Hamburg, Germany,
www.trustcenter.de; Organization Key; <info@trustcenter.de>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.

So 0xBA523901 seems not to be trusted, but when you have a look at the
key, you will see that I signed this key myself (manually removed
signatures, which doesn't matter here):

$ gpg -kvv 0xBA523901
gpg (GnuPG) 0.9.0; Copyright (C) 1998 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

pub 2048R/BA523901 1997-05-07 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Organization Key; <info@trustcenter.de>
sig BA523901 1998-01-05 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Organization Key; <info@trustcenter.de>
sig 57C1C30D 1997-06-24 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; RSA Root Key
uid TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Certificate Administration Key; <certificate@trustcenter.de>
sig DD08DD6D 1998-01-21 Roland Rosenfeld <roland@spinnaker.rhein.de>
sig 43231425 1997-12-11 Max Dornseif <md@rhein.de>
sig BA523901 1998-01-05 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Organization Key; <info@trustcenter.de>
sig 57C1C30D 1997-05-15 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; RSA Root Key

Now I had a look at the trust using gpg --edit-key:

$ gpg --edit-key 0xBA523901
gpg (GnuPG) 0.9.0; Copyright (C) 1998 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

pub 2048R/BA523901 created: 1997-05-07 expires: never trust: m/q
(1) TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Organization Key; <info@trustcenter.de>
(2) TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Certificate Administration Key; <certificate@trustcenter.de>

So I see "trust: m/q". IMHO gpg should find a "marginally trusted
signature" now, but it doesn't.

I temporary changed the trust to "I fully trust" but this also didn't
change anything.

So I had a look at the trust database and got the following:

$ gpgm --list-trust-path 0xBA523901

BA523901.2702:m/- "TC TrustCenter, Hamburg, Germany, www.tr"
DD08DD6D.4215:u/u "Roland Rosenfeld <roland@spinnaker.rhein"

BA523901.2702:m/- "TC TrustCenter, Hamburg, Germany, www.tr"
57C1C30D.2701:-/- "TC TrustCenter, Hamburg, Germany, www.tr"
DD08DD6D.4215:u/u "Roland Rosenfeld <roland@spinnaker.rhein"

BA523901.2702:m/- "TC TrustCenter, Hamburg, Germany, www.tr"
43231425.5625:m/- "Max Dornseif <md@rhein.de>"
DD08DD6D.4215:u/u "Roland Rosenfeld <roland@spinnaker.rhein"

BA523901.2702:m/- "TC TrustCenter, Hamburg, Germany, www.tr"
57C1C30D.2701:-/- "TC TrustCenter, Hamburg, Germany, www.tr"
DD08DD6D.4215:u/u "Roland Rosenfeld <roland@spinnaker.rhein"

BA523901.2702:m/- "TC TrustCenter, Hamburg, Germany, www.tr"
57C1C30D.2701:-/- "TC TrustCenter, Hamburg, Germany, www.tr"
43231425.5625:m/- "Max Dornseif <md@rhein.de>"
DD08DD6D.4215:u/u "Roland Rosenfeld <roland@spinnaker.rhein"

BA523901.2702:m/- "TC TrustCenter, Hamburg, Germany, www.tr"
57C1C30D.2701:-/- "TC TrustCenter, Hamburg, Germany, www.tr"
BB1D9F6D.706:-/- "ct magazine CERTIFICATE <pgpCA@ct.heise."
DD08DD6D.4215:u/u "Roland Rosenfeld <roland@spinnaker.rhein"

[...]

So the trust path seems to be okay, but why do I read
BA523901.2702:m/- "TC TrustCenter, Hamburg, Germany, www.tr"
with the trust parameters "m/-" instead of "m/q" which is displayed
with gpg --edit-key?

Or did I misunderstand anything here?

I use the following options:

force-v3-sigs
load-extension rsa
load-extension idea
escape-from-lines

Ciao

Roland

--
* roland@spinnaker.rhein.de * http://www.rhein.de/~roland/ *
PGP: 1024/DD08DD6D 2D E7 CC DE D5 8D 78 BE 3C A0 A4 F1 4B 09 CE AF
Re: [0.9.0] still problems with trust [ In reply to ]
wk at isil
Jan 7, 1999, 5:28 AM
Post #2 of 3 (200 views)
Permalink
Roland Rosenfeld <roland@spinnaker.rhein.de> writes:

> pub 2048R/BA523901 1997-05-07 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Organization Key; <info@trustcenter.de>
> sig BA523901 1998-01-05 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Organization Key; <info@trustcenter.de>
> sig 57C1C30D 1997-06-24 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; RSA Root Key
> uid TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Certificate Administration Key; <certificate@trustcenter.de>
> sig DD08DD6D 1998-01-21 Roland Rosenfeld <roland@spinnaker.rhein.de>
> sig 43231425 1997-12-11 Max Dornseif <md@rhein.de>
> sig BA523901 1998-01-05 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Organization Key; <info@trustcenter.de>
> sig 57C1C30D 1997-05-15 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; RSA Root Key

Please do a --check-sig in this key.

> BA523901.2702:m/- "TC TrustCenter, Hamburg, Germany, www.tr"
> with the trust parameters "m/-" instead of "m/q" which is displayed

- is unknown
q is undefined

but they mean nearly the same the difference comes from the fact
that it is cached trustdb.

What doesn a gpgm --list-trustdb 0xBA523901 say (only the first part
where the trustdb gets listed) ?
Re: [0.9.0] still problems with trust [ In reply to ]
roland at spinnaker
Jan 7, 1999, 7:27 AM
Post #3 of 3 (210 views)
Permalink
On Thu, 07 Jan 1999, Werner Koch wrote:

> Please do a --check-sig in this key.

This gives me:

pub 2048R/BA523901 1997-05-07 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Organization Key; <info@trustcenter.de>
sig? DD934139 1997-12-25
sig! 5A1D9481 1997-12-09 Andreas M. Rauchenwald <rauchenwald@usa.net>
sig! BA523901 1998-01-05 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Organization Key; <info@trustcenter.de>
sig! 73617099 1997-06-05 Jodok Batlogg <batlogg@ira.uka.de>
sig! 57C1C30D 1997-06-24 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; RSA Root Key
uid TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Certificate Administration Key; <certificate@trustcenter.de>
sig! DD08DD6D 1998-01-21 Roland Rosenfeld <roland@spinnaker.rhein.de>
sig! 43231425 1997-12-11 Max Dornseif <md@rhein.de>
sig! BA523901 1998-01-05 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Organization Key; <info@trustcenter.de>
sig! 57C1C30D 1997-05-15 TC TrustCenter, Hamburg, Germany, www.trustcenter.de; RSA Root Key
sig! CB62BDA1 1997-06-28 Frank Alexander Friedrichs <FRIEDRICHS@GMX.NET>
sig? DA6B0F99 1997-05-29

Maybe the problem is that I signed only one of the two UserIDs? But
this shouldn't be a big problem because there is a self signature
under both UserIDs...?

BTW: The above doesn't change the behavior when checking the message
signature.

> What doesn a gpgm --list-trustdb 0xBA523901 say (only the first part
> where the trustdb gets listed) ?

rec 2702, dir 2702, keys=6289, uids=6290, t=04
rec 6289, key 2702, n=0 a=1 4ABB51BAD50697133ACBCF3076F0AF48, valid
rec 6290, uid 2702, next=6294, pref=0, sig=14022, hash=C72D, valid
rec 14022, sig 2702, next=10833, 5581:?-- 5581:?-- 5581:?--
rec 10833, sig 2702, next=6291, 5581:?-- 5581:?-- 5581:?-- 5581:?-- 5581:?-- 5581:?--
rec 6291, sig 2702, next=0, 5581:?-- 2572:V-- 4539:V-- 6292:?-- 5581:?-- 2701:V--
rec 6294, uid 2702, next=0, pref=0, sig=14023, hash=15FC, valid
rec 14023, sig 2702, next=10834, 10356:?-- 10356:?-- 10356:?--
rec 10834, sig 2702, next=6295, 10356:?-- 10356:?-- 10356:?-- 10356:?-- 10356:?-- 10356:?--
rec 6295, sig 2702, next=0, 4215:?-- 5625:?-- 6292:?-- 5101:?-- 2701:?-- 10356:?--
Signatures of BA523901.2702 "TC TrustCenter, Hamburg, Germany, www.trustcenter.de; Organization Key; <info@trustcenter.de>"

My RSA key is DD08DD6D.4215.

Ciao

Roland

--
* roland@spinnaker.rhein.de * http://www.rhein.de/~roland/ *
PGP: 1024/DD08DD6D 2D E7 CC DE D5 8D 78 BE 3C A0 A4 F1 4B 09 CE AF

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal