Re: SHA1 bindings in your PGP key 4E386D9C9C61702F

[Konstantin Ryabitsev <konstantin@linuxfoundation.org>]

On Wed, Sep 10, 2025 at 08:40:58AM +0200, Willy Tarreau wrote:
> > The issue is that the proofs about your UID and your subkey
> > 014180C7E8419672 belonging to your main key 4E386D9C9C61702F rely on
> > SHA-1 hashes which is considered weak since at least 2005[1]. Practical
> > breakage is not known yet, but still I recommend to update your key to a
> > safer hash algorithm to reduce attacking surface.
> 
> Hmmm unless I'm missing something, these serve to sign tags designating
> a commit that itself relies on SHA-1, no ? So in this case if we don't
> trust the keys anymore because we consider them weak, we shouldn't trust
> the tags nor the commits either ?

Well, there is collision detection code in git to prevent a lot of badness
associated with that attack, and nothing like that in PGP (not sure that's
even possible). So, I wouldn't treat these two problems as the same.

> > Find more details at
> > https://lore.kernel.org/keys/fxotnlhsyl2frp54xtguy7ryrucuwselanazixeax3motyyoo3@7vf7ip6gxyvx/T/#u
> > which also describes a procedure to (hopefully) fix your key.
> 
> Thank you. I must admit I'm a bit lost by the complexity of these
> operations, especially since I don't understand their impact. Does
> this mean that my key that was previously signed will change if I
> do that, and that as such it will have to be signed again ? What
> should I backup before entering these operations in case things go
> wrong or if I simply do a mistake ? I never understand even the
> questions in GPG, so I tend to randomly respond until it works.

It should not impact your signatures in any way, it will just recreate the
certificate that pairs your identity to your primary key.

If you want to feed to birds with one scone, you can just add your kernel.org
identity to your key and then reset your 1wt.eu identity as primary:

    gpg --quick-add-uid 0C9568FA554656551590C5E44E386D9C9C61702F 'Willy Tarreau <wtarreau@kernel.org>'
    gpg --quick-set-primary-uid 0C9568FA554656551590C5E44E386D9C9C61702F 'Willy Tarreau <w@1wt.eu>'

This will make your key discoverable via the kernel.org WKD and fix the
problem with the SHA1 signature.

You then just need to send me the updated key export.

Hope that helps!

-K