Client: Failed to parse public key at position 0

[agriffis]

I've made a team and added members, but I'm getting this:

$ keybase team list-members n01se
▶ NOTICE Failed to parse public key at position 0 [tags:LU=BUv_No0RssBt]
▶ ERROR Bad key family: No key found for 0111638063240b2396557db705cc26a09593e470c9034542282329dec41a92b2cd920a

Uploaded log with keybase log send. Log id is cfcd1738c3d4af796b7d9f1c

[maxtaco]

cc @zapu is this the same key as in keybase friends?

[maxtaco]

Key parsing error: openpgp: unsupported feature: public key type: 20 [tags:ID2=1L7I2DH2PG8z,LU=op4hjz6xdHtw]

[maxtaco]

Hmm, that is a pretty toxic type of key. I guess we should ignore it, but it's bad bad bad!

[agriffis]

@maxtaco Could you tell me more about "toxic" so I know what to say to the key owner?

I agree about ignoring it though. The existence of a problematic PGP subkey shouldn't prevent listing team members, for sure. :-)

[zapu]

@max yes this is the same key and user. sorry for your troubles @agriffis !

[maxtaco]

https://lists.gnupg.org/pipermail/gnupg-users/2004-March/021973.html

[agriffis]

I started to read through that thread. The tl;dr seems to be that there was a bug in GnuPG's Elgamal signing implementation (versus encryption). Among other reasons, such as no other software supporting Elgamal for signatures, they removed it.

So... Keybase fails to parse because GnuPG no longer supports Elgamal signing keys?

Patrick gave me this output:

pub  1024D/F718ED2A  created: 2000-09-07  expires: never       usage: SCA
                     trust: unknown       validity: unknown
sub  1024G/4B5CB23F  created: 2001-04-18  expires: never       usage:
sub  1024g/32946E88  created: 2000-09-07  expired: 2001-09-07  usage: E
sub  2048g/0841B3BE  created: 2006-04-05  expires: never       usage: E

How can I tell what algorithms are in use for what purposes here? I tried to RTFM but can't find any explanation of list-keys output in the GnuPG docs.

And eventually, what does the user need to do to update their key to something that works?

[maxtaco]

We'll look more into it, but I think it's this one: sub 1024G/4B5CB23F created: 2001-04-18 expires: never usage:

[agriffis]

For the sake of anybody who wants to dig into an OpenPGP key, there's some great info here: https://davesteele.github.io/gpg/2014/09/20/anatomy-of-a-gpg-key/

In this case, it appears the user:

1. created a 1024-bit DSA key in 2000. This is the primary key on this keyring, used for signing, authentication and certification of other keys on the ring.
2. at the same time, created a 1024-bit Elgamal subkey for encryption. This is a common pairing, since DSA is a signature algorithm and Elgamal is widely used only for encryption.
3. later on, in 2001, created another 1024-bit Elgamal subkey, this time for signing. This is the problematic key, using algorithm 20 which has at this point been demoted to "reserved" in the spec
4. and in 2006, created a new 2048-bit Elgamal subkey for encryption, presumably because the original 1024-bit one had expired.

One or two things need to happen:

1. Keybase needs to ignore the Elgamal signing key, then this key would at least be usable. After all, it has a DSA-1024 key for signing, and an Elgamal-2048 key for encryption. The signing key is weak by modern standards but should be usable.
2. Maybe the user should consider making a new key entirely. Keeping the current one, even with new subkeys, would depend on the 1024-bit DSA certification key, so it's better to start over. A 4096-bit RSA/RSA (signing/encryption) key would work for the foreseeable future.

Does that sound right?

[maxtaco]

Excellent summary! 👍

[zapu]

@agriffis can you try this again on latest release? Since you are on Linux, you should be able to get fairly fresh build through your package manager.

While this is a real bug that we are now fixing, while testing repros I've just noticed that change not relevant to PGP that happened a while ago would have also "unbroken" team list-members commands in your case.

[agriffis]

@zapu works on v1.0.39-20180103170425+352aaf98a