[Full-disclosure] Using second gpg keyring may be misleading?

There is chance someone exploits this in apt-key...

Attached is a keyring and here is the output:

$rm -rf /home/joro2/.gnupg/ ; gpg --import /usr/share/keyrings/ubuntu-master-keyring.gpg ; gpg --check-sigs --keyring /tmp/sec3
gpg: imported: 1 (RSA: 1)
gpg: no ultimately trusted keys found
/home/joro2/.gnupg/pubring.gpg
------------------------------
pub 4096R/3F272F5B 2007-11-09
uid Ubuntu Archive Master Signing Key <ftpmaster@xxxxxxxxxx>
sig!3 3F272F5B 2007-11-09 Ubuntu Archive Master Signing Key <ftpmaster@xxxxxxxxxx>

/tmp/sec3
---------
pub 1024R/B1C08810 2012-06-14
uid kkkkkkk5 <k@k>
sig!3 B1C08810 2012-06-14 [User ID not found]
sig! 3F272F5B 2012-06-14 Ubuntu Archive Master Signing Key <ftpmaster@xxxxxxxxxx>
sig! 3F272F5B 2012-06-14 Ubuntu Archive Master Signing Key <ftpmaster@xxxxxxxxxx>
sub 1024R/0354AE88 2012-06-14
sig! B1C08810 2012-06-14 [User ID not found]
sub 2179R/3F272F5B 2012-06-14
sig! B1C08810 2012-06-14 [User ID not found]

1 signature not checked due to a missing key


$rm -rf /home/joro2/.gnupg/ ; gpg --import /usr/share/keyrings/ubuntu-master-keyring.gpg ; gpg --no-default-keyring --check-sigs --keyring /tmp/sec3

gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)
gpg: no ultimately trusted keys found
/tmp/sec3
---------
pub 1024R/B1C08810 2012-06-14
uid kkkkkkk5 <k@k>
sig!3 B1C08810 2012-06-14 kkkkkkk5 <k@k>
sig! 3F272F5B 2012-06-14 kkkkkkk5 <k@k>
sig! 3F272F5B 2012-06-14 kkkkkkk5 <k@k>
sub 1024R/0354AE88 2012-06-14
sig! B1C08810 2012-06-14 kkkkkkk5 <k@k>
sub 2179R/3F272F5B 2012-06-14
sig! B1C08810 2012-06-14 kkkkkkk5 <k@k>

Attachment: sec3
Description: Binary data

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages