Re: [gentoo-project] let's stop using short gpg key ids, that's insecure

["Michał Górny" <mgorny@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 928 bytes --]

On Mon, 02 Jan 2012 15:47:23 +0100
""Paweł Hajdan, Jr."" <phajdan.jr@gentoo.org> wrote:

> You've probably read (or should)
> <http://www.asheesh.org/note/debian/short-key-ids-are-bad-news.html>
> which describes why using short gpg key ids is insecure.

Insecure to what? In the same manner, you can say that using your first
and surname is insecure.

> What do you think? Should I file a bug to convert e.g.
> http://www.gentoo.org/proj/en/devrel/roll-call/userinfo.xml ? Or do we
> only have short key IDs in LDAP, which would require everyone to
> submit the full ID?

There's no reason to panic. The trust model of PGP is not based on key
IDs. The short IDs are only used to let users grab our keys at will;
and as the blog post shows, GPG handles repeating key IDs just fine.
I think we can afford that one a million times users will download one
additional key.

-- 
Best regards,
Michał Górny

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 316 bytes --]