Tool Release (GNU Privacy Guard), compliant with OpenPGP standards () and S/MIME, providing utilities for data encryption, working with digital signatures, key management, and access to public key repositories. Remember that the GnuPG 2.2 branch is positioned as a developing release, where new features continue to be added, while only corrective fixes are allowed in the 2.1 branch.
The new release offers measures to counter , which can lead to GnuPG hanging and prevent further operation until the problematic certificate is removed from the local store or the certificate store is recreated based on verified public keys. The added protection relies on completely ignoring by default all third-party digital signatures of certificates obtained from key storage servers. It’s worth noting that any user can add their digital signature for arbitrary certificates on the key storage server, which is exploited by attackers to create a vast number of such signatures (over a hundred thousand) for the victim's certificate, processing of which disrupts the normal operation of GnuPG.
Ignoring third-party digital signatures is governed by the ‘self-sigs-only’ option, which allows loading only the creator's own signatures for keys. To restore the old behavior, you can add the setting ‘keyserver-options no-self-sigs-only,no-import-clean’ to gpg.conf. If a process registers the importation of a number of blocks that would cause the local store (pubring.kbx) to overflow, GnuPG will automatically enable the digital signature ignoring mode (‘self-sigs-only,import-clean’) instead of throwing an error.
To update keys using the mechanism (WKD), the option ‘—locate-external-key’ has been added, which can be used to recreate the certificate store based on verified public keys. When performing the ‘—auto-key-retrieve’ operation, the WKD mechanism is now preferred over key servers. The essence of WKD's operation lies in hosting public keys on the web linked to the domain specified in the email address. For example, for the address ‘test@example.com’, the key can be downloaded via the link ‘https://example.com/.well-known/openpgpkey/hu/183d7d5ab73cfceece9a5594e6039d5a’.
Source: opennet.ru
