6.0.0-git
2020-11-24

[#15043] Public Key Expiration Date is not calculated correctly
Summary Public Key Expiration Date is not calculated correctly
Queue IMP
Queue Version 6.2.27
Type Bug
State Unconfirmed
Priority 1. Low
Owners
Requester horde (at) immerda (dot) ch
Created 2020-11-12 (12 days ago)
Due
Updated 2020-11-12 (12 days ago)
Assigned
Resolved
Milestone
Patch No

History
2020-11-12 16:00:07 horde (at) immerda (dot) ch Comment #2 Reply to this comment
The reason this happens, is as followed:

You are parsing output of  `gpg --list-packets` and calculate the 
wrong dates with each other.

gpg returns "hashed subpkt 9 len 4 (key expires after 7y2d0h23m)"

2017-10-02 + 7y2d0h23m is October 4th 2024

The error is on this line 
https://github.com/horde/Crypt/blob/master/lib/Horde/Crypt/Pgp/Backend/Binary.php#L326

Somehow the wrong date is chose from parsing the packets:

https://github.com/horde/Crypt/blob/master/lib/Horde/Crypt/Pgp/Backend/Binary.php#L182-L352

2020-11-12 13:08:27 horde (at) immerda (dot) ch Comment #1
Type ⇒ Bug
State ⇒ Unconfirmed
Priority ⇒ 1. Low
Summary ⇒ Public Key Expiration Date is not calculated correctly
Queue ⇒ IMP
Milestone ⇒
Patch ⇒ No
Reply to this comment
Importing the following key:

$ cat /tmp/foo
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBFJKtpcBCAC2ZlpvuO4YfMcQ2+e4oBJNnnsl7e47pG9UgjLha6cWA406LxCl
j/2Xs9Yd89RoDUdGbZdmZADKAZWnQ4sdS75P50DgLHyhSVDcZLVef06dicfsObf+
C/x5kpJLhCa4+y39f1FL17qzGT+5ocua64ndQZ2IlLt9TbtoDtqbT+M5RZnoiU3C
HEDatcqlG/9ad3Hr5idapy8o8A5nw/o6peY9bW+QgW0/to5A3MJCgIvwfQiDWtGh
weQW4FN1ZgrCynBStw2yYUV5ThCDsn6OsHxrUlEMB9K8Ew7j0g282XmJ+sPZNaLL
m2IHmYVsPAvdZC/vtKifnAjx402Ui4ZLNLRlABEBAAG0GUphbiBKaXJhdCA8ampp
cmF0QHdvei5jaD6JAT0EEwEKACcCGy8FCwkIBwMFFQoJCAsFFgIDAQACHgECF4AF
AlnSLTMFCQ0rERwACgkQdBT8gwoPLdoHygf/Y19ExXtugErxwbKM7XOMQzVO7mjI
a8rtk3NK4qyWh+jLJ/EAttzzuc02sAaIT1q/cGRWucGTO3K/KRYPrrZmoQbxIqTn
7nFg3THXYkillSff8n9zwGno0hGQczdkTbAJwUy4FFxwvJiPb3rhbW4RXTAnrHdR
txceZnhs/ZzTlPIDmnWO7OG8yEKIFIKc98Klu8DI3ewtWo81k9j1WTvjMVuurx+i
s2EzJQx8ae6qtyDHd7xIhc2B4CnVOK/XzKQ6IRfNlRnbgnRMLCfihr0RFLEDtQRY
MTQOVWUB8IJom7yjWiQ3G0h4cCE5O4wm7pakg/Ga/1lpEkPG/311zze057kBDQRS
SraXAQgAzlfJ9oHeQ4AicCOAbLjXx0EZlbcmXWn4F7ivZZ4rptuFGTQ7mEXguZVM
+lE4BvzfXtOOczgID6gy52vtdKLiX+O1p8ton6R/boanFdBy3NrVWhHiwdmg2B+K
rluEPcePT/JhaBdbwE2++L7QOKbEoS8M6BhHcOyc902gCqCM7OBTktml8lsyqF/f
yDosKQzPg/rwR/1+AODYDxLFO0/1wMu2DwH16n1DreI+2WMLa9CEBo7K1RgSoetq
YtMQ8bIJ1Gx0IJy2ee6YfiMXg02Pbe39DAZQDs3wdFogI6jHz+AzkXTXhknEhR1h
KEubQpAqb635yid3S0khcyt68RlCowARAQABiQJEBBgBCgAPBQJSSraXAhsuBQkH
hh+AASkJEHQU/IMKDy3awF0gBBkBCgAGBQJSSraXAAoJEJtZUlKPJnKThUYH+gP3
jOmh6RM7L+w663k/efPOvhmf4dHgvzcZcdA1SwYT5/Qu+ID9JUreEnWktVqFAhK3
uSyL7N9kvxwP7L3kfTS60AUK+hFaD8mQ6klGmgUM87VFp4vfkoduZrlG0QbaISBX
KbEvJNMzrrGUOPcwsIWcXgj904hz6ZqIhRgt8PeC/KqCaxc7cjlxlo6wUASYaDq2
QQBUNaLPaP5oGnLpT0Y6vrYh2I50r1soVycRgNzVTQL6dp+qNCB+KBKCcPBvfewk
j9zClLuwQMWgWTML2OF/e3sG4S96SY5N2ado2be/J9h4tNZTIT9tNNnwny0u70Xj
LZ712E49BwkqLdyQ/n70VQf/YJ5GBPJXsFlweYlNc4ASNoru8gzfMQkZYxFwj4kh
tF58V5EmRkjgiLWfFatokn09xvo8D9Umu9iyMaFOSG06gYSvq5kGQlDSjy+l8id0
YcW9LT8ebnnUV428MoahQVuIHVzK+UUvQSLMyBwCU+2aiJ4ODoOLw6S8LpwISuZJ
B/1yFwpm6hr7CeytNT3v8sBOvhpl973hinHKCEUd1a3VJXeUs06SBuW4Nf7uECpZ
K7+6fsmaI2DDyAvyyu1j/qu9LKust2yNMRxMTtzyd1jtYSP7JkCKEXFPgYWtsbZi
xVs55F6Hp9pw5wMa7IRKy3EraZ9MlrbwIKiuTNd2Xwn9Ew==
=07yf
-----END PGP PUBLIC KEY BLOCK-----

Gives you the following output under details:

Name:                           Jan Jirat
Schlüsseltyp:                   Öffentlicher Schlüssel
Schlüsselerzeugung:             10/02/17
Verfallsdatum:                  10/04/24
Schlüssellänge:                 2048 Bytes
Kommentar:                      [Keine]
E-Mail-Adresse:                 jjirat@woz.ch
Hash-Algorithmus:               pgp-sha512
Schlüssel-Id:                   0x0A0F2DDA
Fingerabdruck des Schlüssels:   D3D44423F5E33237B497B21D7414FC830A0F2DDA

However the expiration date (Verfallsdatum) is wrong:

$ gpg /tmp/foo
pub   rsa2048/0x7414FC830A0F2DDA 2013-10-01 [SCEA] [expired: 2020-10-01]
       Key fingerprint = D3D4 4423 F5E3 3237 B497  B21D 7414 FC83 0A0F 2DDA
uid                             Jan Jirat <jjirat@woz.ch>
sub   rsa2048/0x9B5952528F267293 2013-10-01 [SEA] [expired: 2017-10-01]

The key is clearly expired, although there are 2 different sigs 
expired at two different set of times. Still nothing makes sense about 
year 2024

Platform: PHP 7.3 / gpg (GnuPG) 2.0.22 / CentOS 7

Saved Queries