New GPG generated keys are 1024 bits

Bug #1240681 reported by vsespb
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Launchpad itself
Fix Released
High
William Grant

Bug Description

Recently I registered an account and started a PPA, new server-side key for binary packages was generated, and it's 1024bits. Isn't this too close to what can be cracked in (near) future?

Related branches

William Grant (wgrant)
Changed in launchpad:
importance: Undecided → High
status: New → Triaged
tags: added: precise-upgrade security
William Grant (wgrant)
Changed in launchpad:
assignee: nobody → William Grant (wgrant)
status: Triaged → In Progress
Revision history for this message
Launchpad QA Bot (lpqabot) wrote :
tags: added: qa-needstesting
Changed in launchpad:
status: In Progress → Fix Committed
William Grant (wgrant)
tags: added: qa-ok
removed: qa-needstesting
William Grant (wgrant)
Changed in launchpad:
status: Fix Committed → Fix Released
Revision history for this message
Andy Brody (abrody) wrote :

When I create a new PPA, it reuses the existing 1024-bit RSA key. IMO this issue is not really fixed since there is no obvious way for existing users to use signing keys with acceptable strength.

https://bugs.launchpad.net/launchpad/+bug/1700167

Revision history for this message
Colin Watson (cjwatson) wrote : Re: [Bug 1240681] Re: New GPG generated keys are 1024 bits

On Tue, May 29, 2018 at 02:02:03AM -0000, Andy Brody wrote:
> When I create a new PPA, it reuses the existing 1024-bit RSA key. IMO
> this issue is not really fixed since there is no obvious way for
> existing users to use signing keys with acceptable strength.
>
> https://bugs.launchpad.net/launchpad/+bug/1700167

That is indeed a problem, but given that that other bug exists there's
no need to reopen this one.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.