Re: DEADBEEF vs SHA1

[Werner Koch <[e-mail]>]

On Thu, 17 Feb 2011 20:12, [e-mail] said:

> import the other one without explicitly deleting the first.  When
> trying to import the second key, GPG fails with "key 689E2211 doesn't
> match our copy".  PGP silently ignores the new key.  Not allowing a
> new key to replace an old one does make some sense (after all, how

Actual this message is here due to my laziness.  A proper implementation
would fallen back to insert that key as a new key.  That would be easy.

The part which requires more work is to change all code looking for a
keyid to iterate over all keyids in the database until it succeeds.  We
do this for example for wildcard keyids.  It turned out that this is
sometimes pretty annoying because the user is forced to enter the
passphrases for all of his keys.  For the case you describe we won't
have this problem but it is nevertheless a lot of work to try all
keyids.  It would be more correct, though.

Disabling v3 import and an option to enable such imports seems to be
justified and is easy to implement.
 

Salam-Shalom,

   Werner


-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.