Re: [Qemu-devel] Reminder: don't trust 32-bit short IDs when using GPG!

[Thomas Huth]

On 10.06.2016 16:46, Peter Maydell wrote:
> We've noticed recently that the GPG keyservers have fake keys for
> some of the QEMU maintainers, which have keys which have been
> deliberately constructed to have collisions on the 32-bit "short ID"
> field which gpg shows you by default.
> 
> (Example:
> https://pgp.mit.edu/pks/lookup?op=vindex&search=0x14360CDE
> shows both my actual key and a fake.)
> 
> It's been known for years that it's pretty easy to construct a
> key with whatever 32-bit short ID you like:
>  http://www.asheesh.org/note/debian/short-key-ids-are-bad-news.html
>  https://evil32.com/

FWIW, seems like the fake keys have finally been revoked on the key
servers (got the news from
http://www.heise.de/newsticker/meldung/Haufenweise-Fake-PGP-Schluessel-im-Umlauf-3297175.html).

 Thomas