Not sure if there might even be security implications: A friend of mine sends signed messages which are always * shown as having a valid signature (green display and everything) * but from a completely wrong sender (!) ****************************************************************** Die Nachricht enthält die Signatur von Klaus@XXXXXXXXX.de (Schlüsselkennung: 0x9F8E2A98D1A4EDE5). Die Signatur ist gültig, und der Schlüssel ist vertrauenswürdig. ****************************************************************** (translation: The message contains the signature of Klaus@XXXXXXXXX.de (Key-ID: 0x9F8E2A98D1A4EDE5). The signature is valid and the key is trusted. ****************************************************************** I have this public key in my keyring, but it has nothing to do with the mail that is displayed - if I extract its PGP signature into a separate file and use gpg to display information about it, the following is displayed: ****************************************************************** $ LANG= gpg --verify sigfile /dev/null gpg: Signature made Tue Sep 29 11:11:08 2015 CEST using RSA key ID 22B2951D gpg: WARNING: digest algorithm MD5 is deprecated gpg: please see https://gnupg.org/faq/weak-digest-algos.html for more information gpg: BAD signature from "Matthias XXXXXXX <matthias@XXXXXXX.de>" ****************************************************************** Neither mail address nor key ID have anything to do with the wrong key that is picked up for display by kMail... I'm also not sure why the wrong key is displayed as "trusted" in the first place - it does not seem to be considered trusted by gpg: ****************************************************************** gpg: using classic trust model pub 2048R/D1A4EDE5 created: 2000-02-26 expires: never usage: SCE trust: undefined validity: unknown ****************************************************************** Reproducible: Always
(eMail addresses anonymized to avoid collection by spam bots.)
i can replicate the issue, i.e., i actually just ran into the same thing, using kmail 5.13.3. this should be considered as a security issue, as someone can be tricked into believing an e-mail came from a certain person when it actually did not. this probably was less of a problem in 2015, but today web key directory support (which is a good thing!) automatically imports available OpenPGP keys into your keyring as soon as you have a fitting mail address in the To: field of the editor (you don't even have to send a mail). even if those addresses aren't signed by you, here's a potential for confusion. kmail should always verify that the sender address is a valid identity of the OpenPGP key used for signing. i would also add that info to the details.