[Bug 857472] Re: net-update verifcation checking insecure

[Colin Watson]

I'm a little worried by the assumption here that adding the key size
check is sufficient.  It's certainly an improvement, but key ID
collisions are clearly possible even without this - they're just more
work.  The key ID isn't *that* long, and it is still many orders of
magnitude easier to construct an attack that involves a key ID collision
than to brute-force the key itself.  Can somebody explain to me how this
approach defends against such an attack?

** Changed in: apt (Ubuntu Oneiric)
     Assignee: (unassigned) => Michael Vogt (mvo)

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/857472

Title:
  net-update verifcation checking insecure

Status in “apt” package in Ubuntu:
  Confirmed
Status in “apt” source package in Oneiric:
  Confirmed

Bug description:
  From:
  http://seclists.org/fulldisclosure/2011/Sep/222

  its easy to bypass the verification checking in apt-key net-update.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/857472/+subscriptions