Groups > linux.debian.user > #196823

Re: Expired GPG keys of older release

From	Ben Finney <bignose@debian.org>
Newsgroups	linux.debian.user
Subject	Re: Expired GPG keys of older release
Date	2018-06-21 04:30 +0200
Message-ID	<w2Xwd-nA-1@gated-at.bofh.it> (permalink)
References	(4 earlier) <w2F6h-4PH-3@gated-at.bofh.it> <w2F6h-4PH-1@gated-at.bofh.it> <w2G2l-5wt-3@gated-at.bofh.it> <w2KfD-fQ-1@gated-at.bofh.it> <w2MU9-2at-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Adam Cecile <adam.cecile@hitec.lu> writes:

> I still thinks it *sucks* to have no alternative then considering
> packages signed by an expired key like unsigned packages....

The key is expired, which means its creator no longer claims it as their
key. Any signatures found using that key, can no longer be known to be
made by the person who nominally owns that key.

In other words: Yes, it's inconvenient, but it's because *no one can
know* with confidence any more whether that key has been compromised.
So that does put it into the same category as “who the hell knows
whether this signature is associated with the key owner”.

That's just a fact that follows from the finite lifetime of the security
of a given key. The longer it's been out there, the larger the window
for compromise; and we're now outside the window where the key owner
warrants to still be in control of that key. Don't trust whatever
signatures you find with that key any more.

-- 
 \     “I have had a perfectly wonderful evening, but this wasn't it.” |
  `\                                                     —Groucho Marx |
_o__)                                                                  |
Ben Finney

Thread

Re: Expired GPG keys of older release john doe <johndoe65534@mail.com> - 2018-06-19 20:40 +0200
  Re: Expired GPG keys of older release john doe <johndoe65534@mail.com> - 2018-06-19 22:00 +0200
  Re: Expired GPG keys of older release Don Armstrong <don@debian.org> - 2018-06-19 22:50 +0200
    Re: Expired GPG keys of older release john doe <johndoe65534@mail.com> - 2018-06-20 08:50 +0200
      Re: Expired GPG keys of older release john doe <johndoe65534@mail.com> - 2018-06-20 09:50 +0200
        Re: Expired GPG keys of older release <tomas@tuxteam.de> - 2018-06-20 10:00 +0200
        Re: Expired GPG keys of older release john doe <johndoe65534@mail.com> - 2018-06-20 10:10 +0200
      Re: Expired GPG keys of older release Greg Wooledge <wooledg@eeg.ccf.org> - 2018-06-20 14:20 +0200
        Re: Expired GPG keys of older release <tomas@tuxteam.de> - 2018-06-20 17:10 +0200
          Re: Expired GPG keys of older release Curt <curty@free.fr> - 2018-06-20 19:10 +0200
            Re: Expired GPG keys of older release <tomas@tuxteam.de> - 2018-06-20 21:20 +0200
              Re: Expired GPG keys of older release Curt <curty@free.fr> - 2018-06-20 22:00 +0200
        Re: Expired GPG keys of older release Greg Wooledge <wooledg@eeg.ccf.org> - 2018-06-20 17:10 +0200
          Re: Expired GPG keys of older release Roberto C. Sánchez <roberto@debian.org> - 2018-06-20 17:20 +0200
            Re: Expired GPG keys of older release Greg Wooledge <wooledg@eeg.ccf.org> - 2018-06-20 17:20 +0200
              Re: Expired GPG keys of older release Roberto C. Sánchez <roberto@debian.org> - 2018-06-20 18:00 +0200
              Re: Expired GPG keys of older release Dan Purgert <dan@djph.net> - 2018-06-20 18:00 +0200
            Re: Expired GPG keys of older release David Wright <deblis@lionunicorn.co.uk> - 2018-06-21 04:00 +0200
        Re: Expired GPG keys of older release Ben Finney <bignose@debian.org> - 2018-06-21 04:30 +0200
          Re: Expired GPG keys of older release rhkramer@gmail.com - 2018-06-21 14:20 +0200
            Re: Expired GPG keys of older release Ben Finney <bignose@debian.org> - 2018-06-22 01:10 +0200
    Re: Expired GPG keys of older release Don Armstrong <don@debian.org> - 2018-06-20 19:40 +0200
      Re: Expired GPG keys of older release <tomas@tuxteam.de> - 2018-06-20 21:30 +0200
        Re: Expired GPG keys of older release Don Armstrong <don@debian.org> - 2018-06-20 22:10 +0200
          Re: Expired GPG keys of older release <tomas@tuxteam.de> - 2018-06-21 09:00 +0200
        Re: Expired GPG keys of older release Ansgar Burchardt <"Ansgar Burchardt"@43-1.org> - 2018-06-21 00:30 +0200
          Re: Expired GPG keys of older release <tomas@tuxteam.de> - 2018-06-21 09:00 +0200

csiph-web