gpg 2.0.22 (Linux) and 1.4.19 (Windows) both sign a message using a partial email match
instead
of exact match even if one is available. This could in theory be used to fool end user to
sign
the message with an attacker's key instead of the intended recipient's key.
How to reproduce:
Create a non-expiring 1024-bit key using DSA and Elgamal for
"Test User <test.user@domain.tld>"
Create a non-expiring 1024-bit key using DSA and Elgamal for
"Real User <user@domain.tld>"
Export these two public keys and import them in another user's (here
another.user@nonexisting.tld) keyring.
$ gpg --list-keys
pub 1024D/C54B0EF7 2016-09-14
uid Test User <test.user@domain.tld>
sub 1024g/1B3AFE1A 2016-09-14
pub 1024D/326E92B6 2016-09-14
uid Real User <user@domain.tld>
sub 1024g/6DF17CD7 2016-09-14
pub 1024D/2DD32AC0 2016-09-14
uid Another User <another.user@nonexisting.tld>
sub 1024g/61CEB02E 2016-09-14
Encrypt and sign a message for user@domain.tld
$ gpg -se -r "user@domain.tld" -a|gpg
You need a passphrase to unlock the secret key for
user: "Another User <another.user@nonexisting.tld>"
1024-bit DSA key, ID 2DD32AC0, created 2016-09-14
Hello, this is a test message.
gpg: encrypted with 1024-bit ELG-E key, ID 1B3AFE1A, created 2016-09-14
"Test User <test.user@domain.tld>"
gpg: decryption failed: secret key not available
The message was actually signed using test.user@domain.tld keys even when user@domain.tld
was
requested.
Attached are the public keys (2 pubkeys, ascii armored) used in this bug report.
Versions found affected:
(Windows, Git Bash)
$ gpg --version
gpg (GnuPG) 1.4.19
Copyright (C) 2015 Free Software Foundation, Inc.
(Linux RHEL 7.2)
$ gpg --version
gpg (GnuPG) 2.0.22
libgcrypt 1.5.3
Copyright (C) 2013 Free Software Foundation, Inc.
(Raspbian)
$ gpg --version
gpg (GnuPG) 1.4.12
Copyright (C) 2012 Free Software Foundation, Inc.