Open ni4 opened 5 years ago
@ni4 I have a related question: rnp
currently doesn't seem to like expired keys, but GnuPG has no problem using expired keys to sign things? Is this correct?
@ronaldtse No, it doesn't seem to be able to sign with expired keys:
gpg: skipped "2FB9179118898E8B": Unusable secret key
gpg: signing failed: Unusable secret key
However, once you own secret key, you may always re-generate self-signature and extend expiration period. And, if key is expired, you still should be able to verify signatures/decrypt data which was created at the time when key was fresh enough. I think we lack some logic behind this, i.e. verification of older sigs with expired keys, importing updated self-signatures (we must ask user whether he would like to extend key expiration time), and so on.
Description
If there is an expired key/subkey pair, then during subkey signature validation incorrect error code returned : invalid signature instead of expired signature.
See below the sample key from the issue #825
expired-key.asc
``` -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFi33EIBEADz1RxlUUPmcE4zLuKmmTlXSsVOnAaRwtOFeA04//LQbJrZNN7S 7Os+IeeJ/sdctXKeb18p68JeXkk9FwVo6CpAuxbhskA79jiyNLcz094Owv1/Exsm kYJSBdWlKl74o9GqBz90lwYaYvMMAe92n8qMEs63s6NKn/AiDe/rFBge+DSXNssc +XmM2ZQAdid9djvLIq1EsKiUoKaoR3USQTWTA8QoA3Q/Apro+sMCuf21drjtCrxA OCjjR/G7G+5C96li0tFddO2mpG9mbdmiJOOyJteq6BBvdKJc/zeKH0JCM9hsPwdN kpCIwtvHgaW/7MiclXqoQ4eFFGX4LN3zN0pKtfHGNRPRdMPSQJ+rSbLWs8DcXS7r otPcCZa/ui0D/3rC5VTgkg2p7nvhc0P/N66hsQFqzLnIdTV5qtPEUZpHYjStIp9u q4Ah/AAluzxVtkc8WgctZ/3PaI7RdicyrC9IlAWPytanrufEvCU22YgpXjAPMzYG NR7XNTbwiKkgR/EhYq9hY+TZ2Qe6AakXoYnYI7W1+f95EbILhZ3lcJMuk2MrRSG8 cVzTEZNHo00NV8wEA71/kJ+MxnYV8wJ2NxUV/6e/bNCMOyaNWdxpw57Az+ccc3wl 4Ety6UtnQKfeUcvl0AOznFHjfzKGVNxw+Rf4mi8+64WiP0OawvJ56UiiEQARAQAB tCZSaWJvc2UgUGFja2FnaW5nIDxwYWNrYWdlc0ByaWJvc2UuY29tPokCPwQTAQgA KQUCWLfcQgIbAwUJAeEzgAcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEFcZ BjotiZj6miEQAKBvMXhpr5HVAEWV7v8qhU7cH5pdQIOtR2TiYCC4o9o59mV2vdkq x+lrsXpcPMRQn0l4WIvLGt6phofqUb6U6Jr+Xa+npdJsZ0uhikNSK2fW0TtidhY3 WVfU5lwhGBocwM6gVA0uJOTNBUa/JB8jXqsTOerS4Rgt68MjpSAJsISpN3X+5jJB xMK0y73RYiL4gyjzkFd8fGlZRLbNE72gae+nhvUq7AdA5m5+QjQCqwm2/USwD0Qa qH5Qs75ZhFkBVWbxpom+UMS6+knhjo93IG8Ro999H4qTmZGsczWZNodLHsAD/s9U Wo3cIcP6mB8rMvQrNKD4YFKOewyPISC3g/VlcQ1AP/XgVNzcDdapeWk164heVej6 fQJG00/Z2S7I/7ihDIGpNeU0SifDWPvPVJ2k030TF1+wLeD5hHK7fas/z3vGLYky 1ToUmBJjZkI6TOFPI8iOHtENvfOkLIXzpom/Z8wjk+jTVT1NAEF+lNq+aLqKguTA WV2mRjOVulXFoDFKjS73BcBXSrD8b/CHreoVuaSx1UWk1cfMmUU2RAP1ptIKZO/J 7oI8KjMbs4VR49Gj2DpGQx6cVvDPy6haJpF4Is48Sl/139dB/v+s6SMQew1YhPcY RqSzD6Tk14M+mSYek0mGRYCfEAjpaqRxpOwRqM+dp7bmsnR6OE+XOEAZuQINBFi3 3EIBEAC0jlnnDbk+tVvoUEBZT5GVTyufthCJlrYpNWCKv4pPtgyAzPjTWsVOok6R JI6wqBw+rsZrK+Oxq0nlAFMbt4d3gHeGpyU7rf5xZDQbxjZNVv3hgLqZkpj+oJIz HJSGDB8ywxuhFFg//gQx0/buRPzn7JZQwCzDgRq1HwuWGxjrrNKPRKzfPU+0lPCh n7SRfQDfPpiihHdI+RcX65uHAehgQEhwKteGYUOgy1KJYXtA+LM+boVHvvMfolQZ CF4ump3SZ0rFoam7gQ1c7UcoXFgQpMZtXirgfU8Xnt5sLRcjgmiM64JnELirFec1 Rzwjlgk3CSNnMPYeJE2ja74X7ggfnYM3z0qVsGJghapQZunoqgFK0++po6pwzavp A3mcjQZTcHYzXYUidCrXXLG93UgRzVu80ybv5BBZtbz5GB0yi6yf2VA4w2Q0dMms 48mLMRk/JjRjUUHnZ2kEmUKwN5tN7aotuaZg8rADDktXEZdjvchYMsfzpKjV8eg8 Lu+C2TXI1bq6zF22JTQbeL0SQ3yUOVes53ZyKreTLlTIU3ERsvQR7HF97WYI/1el 7572FkHleq0Nlg8mdNndK+9JHVAGY5o5lHg4oXwEFrNgfb6e00Dn4aQi9QsvY9Qv 6SpBD5xBe11PozFg5IaG0n5ZoeylABhxWom4PGqxCKVoiY95mwARAQABiQIlBBgB CAAPBQJYt9xCAhsMBQkB4TOAAAoJEFcZBjotiZj6giYQAI7/2tELIxzk6Q1JyhRz TJ9FR0pqZgZcQjnW3+MARD+ZYQhMknIrxhZPxFL2iA7pfTMHlbCuBYMJsea1Rg29 AHK4FlW3jqD+7ITErIQZFxC6j5NxmKTFowd6sQ3lCr8DwnO7fcuOTl+rEpkPJwzG Rz9eumD2Xc2iWkbU4HemG/V0PhxpJPy8hgBz0FRuKtUSCcFt+r5obyMGstR/0PDe MG8diP8H/oEEOa10Vsj0UfEgfMDyP2jGp/ltrnMSabbvuv+puJuG0fpE+mXsQ1OK 8f8fh1/76SIJezN9wFyHoIiZuieLrZu8CYb2Xni4DqyqVIGy49DfpLPQbfQVaW/3 FbdjXYzadfJngehIhRoFIyMdN9khiooozdVk4dYTGZeC5q/qf3uJ9c0dyah9dhwt npJzrgu5jEeneHd34gA9tBFaXKY0c6k0dXHhbXAko+8/qCZxq1HWl3xaFSqSk2KG xvBjBm06DYb6Dg1Y5tq0FEVb9O0Nv9SHPAnvlvlL09cVWYtktkjXIcb1FjoOAl6q MKfjR36eF5wlPdGZ/MNdiYuFQLf/U1jEOLRlTVuNmtT6rKD2FqUC5xscyb86bic3 CXZZLZcsvG0SeiIUKVVasK08jRkXAcT/delsNnO92EsY8KVee+EXuBJweFmi2Tla MmxJsq4yrVw0fTL7NREZ5AV9 =aQaI -----END PGP PUBLIC KEY BLOCK----- ```Steps to Reproduce
rnpkeys --import expired-key.asc
Expected Behavior
Some messages about the expired key/subkey, not about the invalid signature.
Actual Behavior