Subject: [openpgp] OpenPGPv4 long keyid collision test cases?

From: "David Leon Gil" <[email-masked]>
Date: Fri, 13 Dec 2013 07:09:54 -0800 (PST)

I recently needed a pair of OpenPGPv4 keys that collided on long key id. So far as I could tell, there aren't any test-cases around. (Maybe I'm missing something somewhere?)

In any event, I thought that developers of OpenPGPv4-implementing software might find these useful as test-cases for correct behavior in the presence of 64-bit key id collisions. (It's not clear to me, for example, that GnuPG's current behavior is correct, or its output particularly useful when faced with such a collision.)

(These have valid self-certifications of a UID, and so should be importable even by GnuPG.)

Fingerprint: 9E669861368BCA0BE42DAF7D *DDA252EBB8EBE1AF*

- -----BEGIN PGP PUBLIC KEY BLOCK-----

=fDJ8
- -----END PGP PUBLIC KEY BLOCK-----

Fingerprint: A55120427374F3F7AA5F1166 *DDA252EBB8EBE1AF*

- -----BEGIN PGP PUBLIC KEY BLOCK-----

=OEw/
- -----END PGP PUBLIC KEY BLOCK-----

The keys, in binary form, will shortly be available at https://github.com/coruus/cooperpair

(Another few colliding pairs, somewhat less lovely, will also be available there eventually with the private key parameters, in case anyone would like to generate more complex test-cases; 64-bit issuer ids are used so commonly that I suspect it would be useful to test some edge cases that arise as a result.)

Apologies if this is otious and I am missing some obvious source of examples of these. (I noted many comments online that generating 32-bit preimages was 'embarassingly easy'; but no one seems to have bothered to make the time/space tradeoff.)

Cheers,

dlg

(Based on current AWS spot prices for a system similar to the one these were generated on, it costs << 0.05USD to generate 64-bit key id collisions. I arrived at the strategy used to generate these independently, but dkg suggested it in an earlier message on this list. Props, as the young folk today say.)

—
Sent from Mailbox for iPad

---

From: Nicholas Cole <[email-masked]>
Date: Fri, 13 Dec 2013 18:18:36 +0000

On Fri, Dec 13, 2013 at 3:09 PM, David Leon Gil <[email-masked]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> I recently needed a pair of OpenPGPv4 keys that collided on long key id. So
> far as I could tell, there aren't any test-cases around. (Maybe I'm missing
> something somewhere?)

Very interesting.  I can't actually import those keys on GnuPG 2.0.20.
 I get the error "Doesn't match our copy" when I try.

Should you forward your original mail to the gpg developers' list?

N.

---

From: Werner Koch <[email-masked]>
Date: Fri, 13 Dec 2013 22:33:53 +0100

On Fri, 13 Dec 2013 16:09, [email-masked] said:

> In any event, I thought that developers of OpenPGPv4-implementing
> software might find these useful as test-cases for correct behavior in
> the presence of 64-bit key id collisions. (It's not clear to me, for
> example, that GnuPG's current behavior is correct, or its output
> particularly useful when faced with such a collision.)

Thanks, that is useful stuff for regression tests.

Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

---

From: Adam Back <[email-masked]>
Date: Fri, 13 Dec 2013 22:54:42 +0100

Out of interest, I presume you made it via a birthday collision?

Adam