<story><title>Fake Linus Torvalds&apos; Key Found in the Wild, No More Short-IDs</title><url>https://lkml.org/lkml/2016/8/15/445</url></story><parent_chain></parent_chain><comment><author>aftbit</author><text>Hi, Eric here, co-creator of evil32. I posted a brief note on our site about this, but here&amp;#x27;s a little more detail.&lt;p&gt;I found an old (local) backup of the private keys and used it to
generate revocation certificates for each key. Fortunately, there is no
way for anyone else to access or regenerate the private keys for this particular clone of the strong set, and I have
been very careful with my copy - it is only available on my personal
machine, and I have only used it to generate the revocation
certificates. I will not use these keys to generate any fake signatures
nor to decrypt any messages intended for the original recipients.&lt;p&gt;We wanted to bring awareness to the dangers of using short key IDs in
the 21st century, since that ID is very easy to fake, and most of the
contents of the key body are not covered by the signature, so they can
be changed at will. However, we feel that the keys uploaded to the
public keyserver are, on balance, more of harmful to the usability of
the GPG ecosystem than they are helpful in highlighting security flaws.&lt;p&gt;It&amp;#x27;s important to realize that anyone could repeat our work pretty
easily. While we did not release the scripts that automated cloning the
web of trust, the whole process took me less than a week. Cloning a
single key is even easier - it could be done with only a few minutes of
effort by someone familiar with GPG. The GPG ecosystem needs to develop
better defenses to this attack.&lt;p&gt;Our original talk (and previous work) seems to have convinced people to
stop using 32-bit IDs in documentation or on their business cards.
However, there is another common and harmful pattern: users who want to
email someone discover their key by searching the keyserver for that
email, then taking the newest key. This is akin to trust-on-first-use,
and opts out completely from the web of trust or any kind of external
verification.&lt;p&gt;Proof of identity: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;keybase.io&amp;#x2F;aftbit&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;keybase.io&amp;#x2F;aftbit&lt;/a&gt;</text></comment>
<story><title>Fake Linus Torvalds&apos; Key Found in the Wild, No More Short-IDs</title><url>https://lkml.org/lkml/2016/8/15/445</url></story><parent_chain></parent_chain><comment><author>ajdlinux</author><text>All the fake keys that I&amp;#x27;ve seen mentioned are from the data set at &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;evil32.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;evil32.com&lt;/a&gt;.&lt;p&gt;It appears a couple of researchers decided, back in 2014, to demonstrate this issue by cloning the entire strong set of the PGP web of trust (not just Linus&amp;#x27; key, but basically everyone who uses PGP&amp;#x2F;GPG for Free Software development - myself included).&lt;p&gt;It would appear that sometime quite recently, someone decided it would be fun to upload all of those keys (there&amp;#x27;s ~24,000 in their tarball) to the keyservers...&lt;p&gt;One would hope that the researchers behind evil32.com are ethical enough and sensible enough to have permanently destroyed the secret keys - but obviously, anyone could mount this attack quite trivially with modern hardware.&lt;p&gt;So, check your fingerprints!</text></comment>