Re: broken RSA keys

[Solar Designer <solar () openwall com>]

On Thu, May 05, 2016 at 01:03:36PM +0200, Hanno B??ck wrote:
> On Thu, 5 May 2016 13:34:05 +0300 Solar Designer <solar () openwall com> wrote:
> > On Wed, May 04, 2016 at 09:18:26PM -0400, Stanislav Datskovskiy wrote:
> > > older versions of GPG
> > > will regard the bottom 32 bits of a modulus as the 'fingerprint',
> > > rather than performing a hash.
> >
> > Are you sure?
>
> https://tools.ietf.org/html/rfc4880
>
> "V3 keys are deprecated.  They contain three weaknesses.  First, it is
> relatively easy to construct a V3 key that has the same Key ID as any
> other key because the Key ID is simply the low 64 bits of the public
> modulus."

Thanks.  I guess when I imported a PGP 2.6 key to GPG, I just did not
notice this detail, and GPG continued to use the V3 format key for me.

Also from the RFC above:

"  For a V3 key, the eight-octet Key ID consists of the low 64 bits of
   the public modulus of the RSA key.

   The fingerprint of a V3 key is formed by hashing the body (but not
   the two-octet length) of the MPIs that form the key material (public
   modulus n, followed by exponent e) with MD5.  Note that both V3 keys
   and MD5 are deprecated."

So key id was not part of the fingerprint.  That's not how I remember
it, but I'll trust the RFC over my memory.

Alexander