[RFC] OpenWrt impacted by SKS Keyserver Network Attack?

anon45274024 · July 1, 2019, 10:26am

Not scare mongering but certainly appreciate clarification whether this could have a potential impact on the OpenWrt infrastructure a/o software?

Since it mostly pertains to PGP communication I would reckon rather not?

gist.github.com

https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f

keyservers.md

# SKS Keyserver Network Under Attack

_This work is released under a [Creative Commons Attribution-NoDerivatives 4.0 International License](http://creativecommons.org/licenses/by-nd/4.0/)._

## Terminological Note

"OpenPGP" refers to the OpenPGP protocol, in much the same way that HTML refers to the protocol that specifies how to write a web page.  "GnuPG", "SequoiaPGP", "OpenPGP.js", and others are implementations of the OpenPGP protocol in the same way that Mozilla Firefox, Google Chromium, and Microsoft Edge refer to software packages that process HTML data.

## Who am I?

This file has been truncated. show original

slh · July 1, 2019, 10:44am

While it will be hurtful to anyone using gpg/ pgp, it doesn't have any immediate effect on OpenWrt, nor is it actually an attack vector for injecting compromised code (neither into OpenWrt, not GnuPG). Could it eventually have negative effects on the buildbot infrastructure - possibly (albeit not very likely), but also not fatally (temporary denial of service, not an actual security implication).

anon45274024 · July 1, 2019, 1:28pm

That was the concern since the gpg/pgp cryptographic keys are not just utilised in (now supposedly) secure communication but means of verification in various other scenarios and considering the potential outfall

If you fetch a poisoned certificate from the keyserver network, you will break your GnuPG installation.

Of course, if such gpg/pgp cryptographic keys are in not in play then there is not risk