Mailing List Archive: gpg auto-locate-key selects expired/revoked key

gpg auto-locate-key selects expired/revoked key

gnupg-users at gnupg

Jun 8, 2022, 1:13 AM

Post #1 of 17 (1492 views)

Hi,

I just configured WKD on my server, and

gpg -v --auto-key-locate clear,wkd,nodefault --locate-key user@domain.com

works as expected for most of my uid/key combos, except for one address
(olduser@domain.com) which is linked to both a current and a revoked
key. The output of the above command looks like this:

gpg: Note: RFC4880bis features are enabled.
gpg: using pgp trust model
gpg: pub rsa4096/68FD03F8C6AB1DE4 2016-06-15 Old User <olduser@domain.com>
gpg: Note: signature key 68FD03F8C6AB1DE4 expired Mon Jun 14 18:12:44 2021 CEST
gpg: key 68FD03F8C6AB1DE4: "Old Nickname <nickname@domain.com>" not changed
gpg: pub ed25519/7CD4656792B3A1F9 2022-06-06 Old User <newname@domain.com>
gpg: key 7CD4656792B3A1F9: "Old User <olduser@domain.com>" not changed
gpg: Total number processed: 2
gpg: unchanged: 2
gpg: auto-key-locate found fingerprint xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
gpg: Note: signature key 68FD03F8C6AB1DE4 expired Mon Jun 14 18:12:44 2021 CEST
gpg: automatically retrieved 'olduser@domain.com' via WKD
pub rsa4096 2016-06-15 [SC] [revoked: 2022-06-07]
51585E1318770F501D3CBDE968FD03F8C6AB1DE4
uid [ revoked] Old Nickname <nickname@domain.com>
uid [ revoked] Old User <olduser@domain.com>
uid [ revoked] Old Nickname2 <nickname2@domain.com>
sub rsa4096 2016-06-15 [E] [revoked: 2022-06-07]

Even though olduser@domain.com is the primary uid for the new key, gpg
shows the other uid for this key (newname@domain.com). This is odd, but
irrelevant. But then gpg proceeds to select the revoked key which is
somehow available via WKD.

The WKD test at https://metacode.biz/openpgp/web-key-directory delivers
similar results, but at least it displays the fingerprints of both the current
and the revoked key.

Two questions:

- Which WKD server hosts my expired/revoked key such that it takes precedence
over my own WKD server at domain.com?
- Why does gpg select an expired/revoked key over a valid key?

Thanks,
Jan

_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
https://lists.gnupg.org/mailman/listinfo/gnupg-users

gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 7, 2022, 11:46 PM

Post #2 of 17 (1492 views)

Hi,

I just configured WKD on my server, and

gpg -v --auto-key-locate clear,wkd,nodefault --locate-key user@domain.com

works as expected for most of my uid/key combos, except for one address
(olduser@domain.com) which is linked to both a current and a revoked
key. The output of the above command looks like this:

gpg: Note: RFC4880bis features are enabled.
gpg: using pgp trust model
gpg: pub rsa4096/68FD03F8C6AB1DE4 2016-06-15 Old User <olduser@domain.com>
gpg: Note: signature key 68FD03F8C6AB1DE4 expired Mon Jun 14 18:12:44 2021 CEST
gpg: key 68FD03F8C6AB1DE4: "Old Nickname <nickname@domain.com>" not changed
gpg: pub ed25519/7CD4656792B3A1F9 2022-06-06 Old User <newname@domain.com>
gpg: key 7CD4656792B3A1F9: "Old User <olduser@domain.com>" not changed
gpg: Total number processed: 2
gpg: unchanged: 2
gpg: auto-key-locate found fingerprint xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
gpg: Note: signature key 68FD03F8C6AB1DE4 expired Mon Jun 14 18:12:44 2021 CEST
gpg: automatically retrieved 'olduser@domain.com' via WKD
pub rsa4096 2016-06-15 [SC] [revoked: 2022-06-07]
51585E1318770F501D3CBDE968FD03F8C6AB1DE4
uid [ revoked] Old Nickname <nickname@domain.com>
uid [ revoked] Old User <olduser@domain.com>
uid [ revoked] Old Nickname2 <nickname2@domain.com>
sub rsa4096 2016-06-15 [E] [revoked: 2022-06-07]

Even though olduser@domain.com is the primary uid for the new key, gpg
shows the other uid for this key (newname@domain.com). This is odd, but
irrelevant. But then gpg proceeds to select the revoked key which is
somehow available via WKD.

The WKD test at https://metacode.biz/openpgp/web-key-directory delivers
similar results, but at least it displays the fingerprints of both the current
and the revoked key.

Two questions:

- Which WKD server hosts my expired/revoked key such that it takes precedence
over my own WKD server at domain.com?
- Why does gpg select an expired/revoked key over a valid key?

Thanks,
Jan

_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
https://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 8, 2022, 2:51 PM

Post #3 of 17 (1492 views)

On 8 Jun 2022, at 07:46, Jan Eden via Gnupg-users <gnupg-users@gnupg.org> wrote:
>
> - Which WKD server hosts my expired/revoked key such that it takes precedence
> over my own WKD server at domain.com <http://domain.com/>?
> - Why does gpg select an expired/revoked key over a valid key?

I suspect the issue is that your WKD is serving both keys (as you can see from the output of the metacode checker) but GnuPG expects just one key to be served, and so is consuming the first (which is the expired one) and ignoring the second. Try replacing the file on the WKD server with one that contains just the current key?

A

Re: Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 8, 2022, 11:11 PM

Post #4 of 17 (1492 views)

On 2022-06-08 22:51, Andrew Gallagher via Gnupg-users wrote:
> On 8 Jun 2022, at 07:46, Jan Eden via Gnupg-users <gnupg-users@gnupg.org> wrote:
> >
> > - Which WKD server hosts my expired/revoked key such that it takes precedence
> > over my own WKD server at domain.com <http://domain.com/>?
> > - Why does gpg select an expired/revoked key over a valid key?
>
> I suspect the issue is that your WKD is serving both keys (as you can see from the output of the metacode checker) but GnuPG expects just one key to be served, and so is consuming the first (which is the expired one) and ignoring the second. Try replacing the file on the WKD server with one that contains just the current key?

Thanks for the hint! I followed the instructions at
https://shibumi.dev/posts/how-to-setup-your-own-wkd-server/, and
unintentionally exported all keys for the address (gpg --no-armor
--export $uid) instead of specifying the key id.

Now I corrected the mistake, and all is well.

- Jan

PS. The key used to sign your message seems to be expired.

Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 9, 2022, 1:40 AM

Post #5 of 17 (1492 views)

On Thu, 9 Jun 2022 08:11, Jan Eden said:

> Now I corrected the mistake, and all is well.

I don't think this is your mistake. We need to do something about it.
Tracked at https://dev.gnupg.org/T6023

BTW, to ignore local keys and update from WKD (or whatever has been
configured) you can use --locate-external-key which is available since
2.2.17.

Shalom-Salam,

Werner

--
The pioneers of a warless world are the youth that
refuse military service. - A. Einstein

Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 9, 2022, 3:37 AM

Post #6 of 17 (1492 views)

On 09/06/2022 07:11, Jan Eden wrote:
> PS. The key used to sign your message seems to be expired.

That could be because you already had my key in your keyring and it
wasn't recently (i.e. in the last 18 months) refreshed. What does it say
if you incant the following?

```
gpg --refresh-key 0xFB73E21AF1163937
```

A

Re: Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 9, 2022, 3:50 AM

Post #7 of 17 (1492 views)

On 2022-06-09 11:37, Andrew Gallagher wrote:
> On 09/06/2022 07:11, Jan Eden wrote:
> > PS. The key used to sign your message seems to be expired.
>
> That could be because you already had my key in your keyring and it
> wasn't recently (i.e. in the last 18 months) refreshed. What does it say
> if you incant the following?
>
> ```
> gpg --refresh-key 0xFB73E21AF1163937
> ```

jan ~ % gpg --refresh-key 0xFB73E21AF1163937
gpg: refreshing 1 key from hkp://pgp.surf.nl
gpg: key FB73E21AF1163937: "Andrew Gallagher <andrewg@andrewg.com>" not changed
gpg: Total number processed: 1
gpg: unchanged: 1

- Jan

Re: Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 9, 2022, 3:52 AM

Post #8 of 17 (1492 views)

On 2022-06-09 10:40, Werner Koch wrote:
> On Thu, 9 Jun 2022 08:11, Jan Eden said:
>
> > Now I corrected the mistake, and all is well.
>
> I don't think this is your mistake. We need to do something about it.
> Tracked at https://dev.gnupg.org/T6023
>
> BTW, to ignore local keys and update from WKD (or whatever has been
> configured) you can use --locate-external-key which is available since
> 2.2.17.

Thank you (both for the task and the suggestion)!

Best,
Jan

Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 9, 2022, 4:08 AM

Post #9 of 17 (1492 views)

On 09/06/2022 11:50, Jan Eden wrote:
> jan ~ % gpg --refresh-key 0xFB73E21AF1163937
> gpg: refreshing 1 key from hkp://pgp.surf.nl
> gpg: key FB73E21AF1163937: "Andrew Gallagher <andrewg@andrewg.com>" not changed
> gpg: Total number processed: 1
> gpg: unchanged: 1

You're using the pgp.surf.nl keyserver, but it has been broken for some
time (it's currently lagging by about 360 thousand keys). pgp.surf.nl
was configured by default in some previous releases of gnupg but has
since been replaced.

You should edit dirmngr.conf and change your default keyserver to e.g.
keys.openpgp.org or keyserver.ubuntu.com (other keyservers are
available, see https://spider.pgpkeys.eu).

Example:

```
% more ~/.gnupg/dirmngr.conf
keyserver hkps://pgpkeys.eu
```

A

Re: Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 9, 2022, 4:20 AM

Post #10 of 17 (1492 views)

On 2022-06-09 12:08, Andrew Gallagher wrote:
> On 09/06/2022 11:50, Jan Eden wrote:
> > jan ~ % gpg --refresh-key 0xFB73E21AF1163937
> > gpg: refreshing 1 key from hkp://pgp.surf.nl
> > gpg: key FB73E21AF1163937: "Andrew Gallagher <andrewg@andrewg.com>" not changed
> > gpg: Total number processed: 1
> > gpg: unchanged: 1
>
> You're using the pgp.surf.nl keyserver, but it has been broken for some
> time (it's currently lagging by about 360 thousand keys). pgp.surf.nl
> was configured by default in some previous releases of gnupg but has
> since been replaced.
>
> You should edit dirmngr.conf and change your default keyserver to e.g.
> keys.openpgp.org or keyserver.ubuntu.com (other keyservers are
> available, see https://spider.pgpkeys.eu).
>
> Example:
>
> ```
> % more ~/.gnupg/dirmngr.conf
> keyserver hkps://pgpkeys.eu
> ```

I had configured hkp://keys.gnupg.net in gpg.conf (no separate
dirmngr.conf). Switching to keys.openpgp.org had the desired effect:

jan ~ % gpg --refresh-key 0xFB73E21AF1163937
gpg: refreshing 1 key from hkp://keys.openpgp.org
gpg: key FB73E21AF1163937: "Andrew Gallagher <andrewg@andrewg.com>" 8 new signatures
gpg: Total number processed: 1
gpg: new signatures: 8

Thanks,
Jan

Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 9, 2022, 5:01 AM

Post #11 of 17 (1492 views)

On 09/06/2022 12:20, Jan Eden wrote:
> I had configured hkp://keys.gnupg.net in gpg.conf (no separate
> dirmngr.conf). Switching to keys.openpgp.org had the desired effect:

keys.gnupg.net has not existed for a few years now, but for backwards
compatibility gnupg silently maps it to the hardcoded default server. So
setting keys.gnupg.net in your config effectively does nothing...

A

Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 9, 2022, 8:38 AM

Post #12 of 17 (1492 views)

I just looked at what Kleopatra has it set for and it has it set for
hkp://keys.gnupg.net as well. I'm guessing that is no longer the best
choice?

On 6/9/2022 5:01 AM, Andrew Gallagher via Gnupg-users wrote:
> On 09/06/2022 12:20, Jan Eden wrote:
>> I had configured hkp://keys.gnupg.net in gpg.conf (no separate
>> dirmngr.conf). Switching to keys.openpgp.org had the desired effect:
> keys.gnupg.net has not existed for a few years now, but for backwards
> compatibility gnupg silently maps it to the hardcoded default server. So
> setting keys.gnupg.net in your config effectively does nothing...
>
> A
>
>
> _______________________________________________
> Gnupg-users mailing list
> Gnupg-users@gnupg.org
> https://lists.gnupg.org/mailman/listinfo/gnupg-users

--
PGP Key Upon Request

_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
https://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

kloecker at kde

Jun 9, 2022, 12:40 PM

Post #13 of 17 (1491 views)

On Donnerstag, 9. Juni 2022 17:38:04 CEST Mark via Gnupg-users wrote:
> I just looked at what Kleopatra has it set for and it has it set for
> hkp://keys.gnupg.net as well. I'm guessing that is no longer the best
> choice?

Kleopatra 3.1.21.220401 uses whatever `gpgconf --list-options dirmngr` returns
as value for `keyserver`. So it depends on the version of GnuPG you are using.
The default returned by gpgconf 2.3.6 is hkps://keyserver.ubuntu.com.

As Andrew wrote, hkp://keys.gnupg.net is mapped internally by dirmngr to the
default keyserver. For a short while, hkp://keys.gnupg.net was mapped to
hkp://pgp.surf.nl while hkps://keys.gnupg.net was mapped to
hkps://keyserver.ubuntu.com. Since 2.3.5 all URLs with domain name
keys.gnupg.net are mapped to hkps://keyserver.ubuntu.com. The latest 2.2
version still uses hkp://pgp.surf.nl for non-TLS keys.gnupg.net URLs.

Conclusion: For GnuPG 2.3.5 and later hkp://keys.gnupg.net is as good as not
setting a keyserver or as setting it to hkps://keyserver.ubuntu.com. If you
are using a recent GnuPG 2.2, then hkp://keys.gnupg.net is not a good choice.
It's much better not to set a keyserver at all and go with the default. Even
for GnuPG 2.3.5 not setting keyserver is the way to go unless you really want
to use a specific keyserver.

Regards,
Ingo

Re: Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 9, 2022, 1:13 PM

Post #14 of 17 (1491 views)

On 2022-06-09 21:40, Ingo Kl?cker wrote:
> On Donnerstag, 9. Juni 2022 17:38:04 CEST Mark via Gnupg-users wrote:
> > I just looked at what Kleopatra has it set for and it has it set for
> > hkp://keys.gnupg.net as well. I'm guessing that is no longer the best
> > choice?
>
> Kleopatra 3.1.21.220401 uses whatever `gpgconf --list-options dirmngr` returns
> as value for `keyserver`. So it depends on the version of GnuPG you are using.
> The default returned by gpgconf 2.3.6 is hkps://keyserver.ubuntu.com.
>
> As Andrew wrote, hkp://keys.gnupg.net is mapped internally by dirmngr to the
> default keyserver. For a short while, hkp://keys.gnupg.net was mapped to
> hkp://pgp.surf.nl while hkps://keys.gnupg.net was mapped to
> hkps://keyserver.ubuntu.com. Since 2.3.5 all URLs with domain name
> keys.gnupg.net are mapped to hkps://keyserver.ubuntu.com. The latest 2.2
> version still uses hkp://pgp.surf.nl for non-TLS keys.gnupg.net URLs.
>
> Conclusion: For GnuPG 2.3.5 and later hkp://keys.gnupg.net is as good as not
> setting a keyserver or as setting it to hkps://keyserver.ubuntu.com. If you
> are using a recent GnuPG 2.2, then hkp://keys.gnupg.net is not a good choice.
> It's much better not to set a keyserver at all and go with the default. Even
> for GnuPG 2.3.5 not setting keyserver is the way to go unless you really want
> to use a specific keyserver.

That's interesting, because I had configured hkp://keys.gnupg.net in
gpg.conf (deprecated, I know) with GnuPG 2.3.4 and was not able to
refresh Andrew's keys. Only after changing the keyserver option to
hkp://keys.openpgp.org, I received the updated keys.

`gpgconf --list-options dirmngr` returns hkps://keyserver.ubuntu.com,
though.

- Jan

Re: Re: Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 9, 2022, 1:29 PM

Post #15 of 17 (1491 views)

On 2022-06-09 22:13, Jan Eden via Gnupg-users wrote:
>
> On 2022-06-09 21:40, Ingo Klöcker wrote:
> > On Donnerstag, 9. Juni 2022 17:38:04 CEST Mark via Gnupg-users wrote:
> > > I just looked at what Kleopatra has it set for and it has it set for
> > > hkp://keys.gnupg.net as well. I'm guessing that is no longer the best
> > > choice?
> >
> > Kleopatra 3.1.21.220401 uses whatever `gpgconf --list-options dirmngr` returns
> > as value for `keyserver`. So it depends on the version of GnuPG you are using.
> > The default returned by gpgconf 2.3.6 is hkps://keyserver.ubuntu.com.
> >
> > As Andrew wrote, hkp://keys.gnupg.net is mapped internally by dirmngr to the
> > default keyserver. For a short while, hkp://keys.gnupg.net was mapped to
> > hkp://pgp.surf.nl while hkps://keys.gnupg.net was mapped to
> > hkps://keyserver.ubuntu.com. Since 2.3.5 all URLs with domain name
> > keys.gnupg.net are mapped to hkps://keyserver.ubuntu.com. The latest 2.2
> > version still uses hkp://pgp.surf.nl for non-TLS keys.gnupg.net URLs.
> >
> > Conclusion: For GnuPG 2.3.5 and later hkp://keys.gnupg.net is as good as not
> > setting a keyserver or as setting it to hkps://keyserver.ubuntu.com. If you
> > are using a recent GnuPG 2.2, then hkp://keys.gnupg.net is not a good choice.
> > It's much better not to set a keyserver at all and go with the default. Even
> > for GnuPG 2.3.5 not setting keyserver is the way to go unless you really want
> > to use a specific keyserver.
>
> That's interesting, because I had configured hkp://keys.gnupg.net in
> gpg.conf (deprecated, I know) with GnuPG 2.3.4 and was not able to
> refresh Andrew's keys. Only after changing the keyserver option to
> hkp://keys.openpgp.org, I received the updated keys.
>
> `gpgconf --list-options dirmngr` returns hkps://keyserver.ubuntu.com,
> though.

Sorry, the output of gpgconf referred to a changed configuration. This
is what happens for me with GnuPG 2.3.4:

value for `keyserver` in gpg.conf ? keyserver used with `--refresh-key`
hkp://keys.gnupg.net ? hkp://pgp.surf.nl
hkp://keys.openpgp.org ? hkp://keys.openpgp.org
[empty] ? hkps://keyserver.ubuntu.com

- Jan

Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

kloecker at kde

Jun 9, 2022, 1:43 PM

Post #16 of 17 (1491 views)

On Donnerstag, 9. Juni 2022 22:29:52 CEST Jan Eden via Gnupg-users wrote:
> Sorry, the output of gpgconf referred to a changed configuration. This
> is what happens for me with GnuPG 2.3.4:
>
> value for `keyserver` in gpg.conf ? keyserver used with `--refresh-key`
> hkp://keys.gnupg.net ? hkp://pgp.surf.nl
> hkp://keys.openpgp.org ? hkp://keys.openpgp.org
> [empty] ? hkps://keyserver.ubuntu.com

Which matches what I wrote. Additionally you should see
hkps://keys.gnupg.net ? hkps://keyserver.ubuntu.com

Regards,
Ingo

Re: Re: Re: gpg auto-locate-key selects expired/revoked key [ In reply to ]

gnupg-users at gnupg

Jun 19, 2022, 12:17 AM

Post #17 of 17 (1404 views)

On 2022-06-09 12:52, Jan Eden via Gnupg-users wrote:
> On 2022-06-09 10:40, Werner Koch wrote:
> > On Thu, 9 Jun 2022 08:11, Jan Eden said:
> >
> > > Now I corrected the mistake, and all is well.
> >
> > I don't think this is your mistake. We need to do something about it.
> > Tracked at https://dev.gnupg.org/T6023
> >
> > BTW, to ignore local keys and update from WKD (or whatever has been
> > configured) you can use --locate-external-key which is available since
> > 2.2.17.
>
> Thank you (both for the task and the suggestion)!

Following up on this issue: I now use the command suggested at
https://wiki.gnupg.org/WKDHosting with a filter for the revoked key's
fingerprint:

gpg --list-options show-only-fpr-mbox -k '@eden.one' | grep -v zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz | gpg-wks-client -v --directory /var/www/html/site/.well-known/openpgpkey --install-key

As I have only a single key to exclude, this is a viable solution for
me.

- Jan