SHA1KeyFix.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "a7080901-eaa9-4334-83b5-dd77cc7815d1",
   "metadata": {},
   "source": [
    "# SHA1 key fix for the Elasticsearch Signing Key"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "0738b553-e18b-482b-9def-617fa962652a",
   "metadata": {},
   "source": [
    "The Elasticsearch Signing Key can't currently be imported on RHEL9 becuase it has self signatures that use SHA1 as the digest algorithm and RHEL9 no longer recognizes SHA1 as valid. This notebook demonstrates the issue and a solution that can be applied without migrating to a new key."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e9e87e2e-25d0-4377-ae49-b39cb46629ce",
   "metadata": {},
   "source": [
    "## Setup"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "75d49011-979f-46aa-a2a4-d7413e2dc1da",
   "metadata": {},
   "source": [
    "#### Get a RHEL9 machine"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "id": "83c4aae9-5f24-43d8-ac10-be13e9c7fef4",
   "metadata": {},
   "outputs": [],
   "source": [
    "!echo -e '\\\n",
    "Vagrant.configure(\"2\") do |config|\\n\\\n",
    "  config.vm.box = \"generic/rhel9\"\\n\\\n",
    "  config.vm.synced_folder \".\", \"/vagrant\"\\n\\\n",
    "end\\n\\\n",
    "' > Vagrantfile"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "id": "297cc2ba-d207-4279-8a76-a9b9baa961bb",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[0mBringing machine 'default' up with 'virtualbox' provider...\u001b[0m\n",
      "\u001b[1m==> default: Importing base box 'generic/rhel9'...\u001b[0m\n",
      "\u001b[K\u001b[0m\u001b[0mProgress: 90%\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[1m==> default: Matching MAC address for NAT networking...\u001b[0m\n",
      "\u001b[1m==> default: Checking if box 'generic/rhel9' version '4.2.16' is up to date...\u001b[0m\n",
      "\u001b[1m==> default: Setting the name of the VM: sha1-key-fix_default_1691418654752_40751\u001b[0m\n",
      "\u001b[1m==> default: Clearing any previously set network interfaces...\u001b[0m\n",
      "\u001b[1m==> default: Preparing network interfaces based on configuration...\u001b[0m\n",
      "\u001b[0m    default: Adapter 1: nat\u001b[0m\n",
      "\u001b[1m==> default: Forwarding ports...\u001b[0m\n",
      "\u001b[0m    default: 22 (guest) => 2222 (host) (adapter 1)\u001b[0m\n",
      "\u001b[1m==> default: Running 'pre-boot' VM customizations...\u001b[0m\n",
      "\u001b[1m==> default: Booting VM...\u001b[0m\n",
      "\u001b[1m==> default: Waiting for machine to boot. This may take a few minutes...\u001b[0m\n",
      "\u001b[0m    default: SSH address: 127.0.0.1:2222\u001b[0m\n",
      "\u001b[0m    default: SSH username: vagrant\u001b[0m\n",
      "\u001b[0m    default: SSH auth method: private key\u001b[0m\n",
      "\u001b[0m    default: \n",
      "    default: Vagrant insecure key detected. Vagrant will automatically replace\n",
      "    default: this with a newly generated keypair for better security.\u001b[0m\n",
      "\u001b[0m    default: \n",
      "    default: Inserting generated public key within guest...\u001b[0m\n",
      "\u001b[0m    default: Removing insecure key from the guest if it's present...\u001b[0m\n",
      "\u001b[0m    default: Key inserted! Disconnecting and reconnecting using new SSH key...\u001b[0m\n",
      "\u001b[1m==> default: Machine booted and ready!\u001b[0m\n",
      "\u001b[1m==> default: Checking for guest additions in VM...\u001b[0m\n",
      "\u001b[0m    default: The guest additions on this VM do not match the installed version of\n",
      "    default: VirtualBox! In most cases this is fine, but in rare cases it can\n",
      "    default: prevent things such as shared folders from working properly. If you see\n",
      "    default: shared folder errors, please make sure the guest additions within the\n",
      "    default: virtual machine match the version of VirtualBox you have installed on\n",
      "    default: your host and reload your VM.\n",
      "    default: \n",
      "    default: Guest Additions Version: 6.1.40\n",
      "    default: VirtualBox Version: 7.0\u001b[0m\n",
      "\u001b[1m==> default: Mounting shared folders...\u001b[0m\n",
      "\u001b[0m    default: /vagrant => /home/chrisberkhout/Code/sha1-key-fix\u001b[0m\n"
     ]
    }
   ],
   "source": [
    "!vagrant up"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "c47d053c-622a-4d98-8a6c-89952c8db240",
   "metadata": {},
   "source": [
    "## The issue"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "08b715d0-da1e-4ebd-a8de-3cbc25a477ce",
   "metadata": {},
   "source": [
    "#### Get the Elasticsearch Signing Key and attempt to import it"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "884847e1-a3d3-479c-b746-08dd066b1634",
   "metadata": {},
   "outputs": [],
   "source": [
    "!curl -s 'https://artifacts.elastic.co/GPG-KEY-elasticsearch' > GPG-KEY-elasticsearch"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "id": "ac894ee8-6940-4c8a-9d3b-4f5c1c817adc",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "warning: Signature not supported. Hash algorithm SHA1 not available.\n",
      "error: /vagrant/GPG-KEY-elasticsearch: key 1 import failed.\n"
     ]
    }
   ],
   "source": [
    "!vagrant ssh -c 'sudo rpm --import /vagrant/GPG-KEY-elasticsearch'"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "006b3094-fbbe-4085-885c-fc448378dc54",
   "metadata": {},
   "source": [
    "This is the problem we want to fix."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "0f0f9591-cdee-4cca-8907-e0f377f65ec8",
   "metadata": {},
   "source": [
    "#### Examine the key details"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "id": "1955310d-4508-443d-8301-45acfc4c5777",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "pub   rsa2048/0xD27D666CD88E42B4 2013-09-16 [SC]\n",
      "      Key fingerprint = 4609 5ACC 8548 582C 1A26  99A9 D27D 666C D88E 42B4\n",
      "uid                             Elasticsearch (Elasticsearch Signing Key) <dev_ops@elasticsearch.org>\n",
      "sub   rsa2048/0xAB6B7FCB60D31954 2013-09-16 [E]\n",
      "      Key fingerprint = 3B0C 6695 3876 82E1 8F77  B489 AB6B 7FCB 60D3 1954\n"
     ]
    }
   ],
   "source": [
    "!gpg --with-fingerprint GPG-KEY-elasticsearch 2>/dev/null"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "f34fc5da-7f58-4414-b05f-8deb7cb58259",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "# off=0 ctb=99 tag=6 hlen=3 plen=269\n",
      ":public key packet:\n",
      "\tversion 4, algo 1, created 1379344074, expires 0\n",
      "\tpkey[0]: [2048 bits]\n",
      "\tpkey[1]: [17 bits]\n",
      "\tkeyid: D27D666CD88E42B4\n",
      "# off=272 ctb=b4 tag=13 hlen=2 plen=69\n",
      ":user ID packet: \"Elasticsearch (Elasticsearch Signing Key) <dev_ops@elasticsearch.org>\"\n",
      "# off=343 ctb=89 tag=2 hlen=3 plen=312\n",
      ":signature packet: algo 1, keyid D27D666CD88E42B4\n",
      "\tversion 4, created 1379344074, md5len 0, sigclass 0x13\n",
      "\tdigest algo 2, begin of digest 73 8c\n",
      "\thashed subpkt 2 len 4 (sig created 2013-09-16)\n",
      "\thashed subpkt 27 len 1 (key flags: 03)\n",
      "\thashed subpkt 11 len 5 (pref-sym-algos: 9 8 7 3 2)\n",
      "\thashed subpkt 21 len 5 (pref-hash-algos: 8 2 9 10 11)\n",
      "\thashed subpkt 22 len 3 (pref-zip-algos: 2 3 1)\n",
      "\thashed subpkt 30 len 1 (features: 01)\n",
      "\thashed subpkt 23 len 1 (keyserver preferences: 80)\n",
      "\tsubpkt 16 len 8 (issuer key ID D27D666CD88E42B4)\n",
      "\tdata: [2048 bits]\n",
      "# off=658 ctb=b9 tag=14 hlen=3 plen=269\n",
      ":public sub key packet:\n",
      "\tversion 4, algo 1, created 1379344074, expires 0\n",
      "\tpkey[0]: [2048 bits]\n",
      "\tpkey[1]: [17 bits]\n",
      "\tkeyid: AB6B7FCB60D31954\n",
      "# off=930 ctb=89 tag=2 hlen=3 plen=287\n",
      ":signature packet: algo 1, keyid D27D666CD88E42B4\n",
      "\tversion 4, created 1379344074, md5len 0, sigclass 0x18\n",
      "\tdigest algo 2, begin of digest 73 73\n",
      "\thashed subpkt 2 len 4 (sig created 2013-09-16)\n",
      "\thashed subpkt 27 len 1 (key flags: 0C)\n",
      "\tsubpkt 16 len 8 (issuer key ID D27D666CD88E42B4)\n",
      "\tdata: [2048 bits]\n"
     ]
    }
   ],
   "source": [
    "!gpg --list-packets GPG-KEY-elasticsearch"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "58c7809e-0abd-468c-add6-f30ec8eb3093",
   "metadata": {},
   "source": [
    "RSA (Encrypt or Sign) is the public key algorithm used, indicated by `algo 1` in the `public key packet`, `signature packet`, and `public sub key packet` sections.\n",
    "\n",
    "SHA1 is the digest algorithm used for the signatures, indicated by `digest algo 2` in the `signature packet` sections. This needs to change."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d2fe5dc5-3464-4c70-9002-8faafc076390",
   "metadata": {},
   "source": [
    "## The solution"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "67531908-f062-4020-854c-19b21bd1dd20",
   "metadata": {},
   "source": [
    "To demonstrate the solution we'll start with a new key that uses SHA1 as its digest algorithm. Then we'll edit the key to trigger the generation of new self-signatures, verify that the signatures have changed and that the key IDs and fingerprints have not changed, and finally, show that the fixed key can be imported successfully."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "eda3aef8-5e4b-4a57-a4b9-d7e706ea66d2",
   "metadata": {},
   "source": [
    "#### Generate a key with SHA1 signatures"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "id": "b948bc99-b139-4398-9c35-8a6a790ee9fe",
   "metadata": {},
   "outputs": [],
   "source": [
    "!echo -e '\\\n",
    "%echo Generating a basic OpenPGP key\\n\\\n",
    "Key-Type: RSA\\n\\\n",
    "Key-Length: 2048\\n\\\n",
    "Subkey-Type: RSA\\n\\\n",
    "Subkey-Length: 2048\\n\\\n",
    "Name-Real: My Name\\n\\\n",
    "Name-Comment: Some Comment\\n\\\n",
    "Name-Email: keymaster@example.com\\n\\\n",
    "Expire-Date: 0\\n\\\n",
    "Passphrase: some-passphrase\\n\\\n",
    "%commit\\n\\\n",
    "%echo done\\\n",
    "' > key-options.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "id": "9c0063c6-bf53-4de8-b875-aeca6834292f",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "gpg: Generating a basic OpenPGP key\n",
      "gpg: revocation certificate stored as '/home/chrisberkhout/.gnupg/openpgp-revocs.d/E51EB50C358F7FD6AFF778E0503D4EEE85D18576.rev'\n",
      "gpg: done\n"
     ]
    }
   ],
   "source": [
    "!gpg --options <(echo -e \"cert-digest-algo SHA1\") --allow-weak-key-signatures --batch --generate-key key-options.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "id": "feaf7f79-7296-484f-af05-859565a8d871",
   "metadata": {},
   "outputs": [],
   "source": [
    "!gpg --armor --export keymaster@example.com > publickey-sha1.asc"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "id": "f1c559f4-dfeb-4a2a-aeb6-154f4950358d",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "pub   rsa2048/0x503D4EEE85D18576 2023-08-07 [SCEA]\n",
      "      Key fingerprint = E51E B50C 358F 7FD6 AFF7  78E0 503D 4EEE 85D1 8576\n",
      "uid                             My Name (Some Comment) <keymaster@example.com>\n",
      "sub   rsa2048/0xF21B1176DBB44885 2023-08-07 [SEA]\n",
      "      Key fingerprint = 23F7 B353 929D 7658 5D35  1C12 F21B 1176 DBB4 4885\n"
     ]
    }
   ],
   "source": [
    "!gpg --with-fingerprint publickey-sha1.asc 2>/dev/null | tee publickey-sha1-fingerprints.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "id": "aacc7413-2ea9-4d3c-96e1-3ba6cc8dd3a5",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "# off=0 ctb=99 tag=6 hlen=3 plen=269\n",
      ":public key packet:\n",
      "\tversion 4, algo 1, created 1691418803, expires 0\n",
      "\tpkey[0]: [2048 bits]\n",
      "\tpkey[1]: [17 bits]\n",
      "\tkeyid: 503D4EEE85D18576\n",
      "# off=272 ctb=b4 tag=13 hlen=2 plen=46\n",
      ":user ID packet: \"My Name (Some Comment) <keymaster@example.com>\"\n",
      "# off=320 ctb=89 tag=2 hlen=3 plen=334\n",
      ":signature packet: algo 1, keyid 503D4EEE85D18576\n",
      "\tversion 4, created 1691418803, md5len 0, sigclass 0x13\n",
      "\tdigest algo 2, begin of digest 34 86\n",
      "\thashed subpkt 33 len 21 (issuer fpr v4 E51EB50C358F7FD6AFF778E0503D4EEE85D18576)\n",
      "\thashed subpkt 2 len 4 (sig created 2023-08-07)\n",
      "\thashed subpkt 27 len 1 (key flags: 2F)\n",
      "\thashed subpkt 11 len 4 (pref-sym-algos: 9 8 7 2)\n",
      "\thashed subpkt 21 len 5 (pref-hash-algos: 10 9 8 11 2)\n",
      "\thashed subpkt 22 len 3 (pref-zip-algos: 2 3 1)\n",
      "\thashed subpkt 30 len 1 (features: 01)\n",
      "\thashed subpkt 23 len 1 (keyserver preferences: 80)\n",
      "\tsubpkt 16 len 8 (issuer key ID 503D4EEE85D18576)\n",
      "\tdata: [2042 bits]\n",
      "# off=657 ctb=b9 tag=14 hlen=3 plen=269\n",
      ":public sub key packet:\n",
      "\tversion 4, algo 1, created 1691418803, expires 0\n",
      "\tpkey[0]: [2048 bits]\n",
      "\tpkey[1]: [17 bits]\n",
      "\tkeyid: F21B1176DBB44885\n",
      "# off=929 ctb=89 tag=2 hlen=3 plen=620\n",
      ":signature packet: algo 1, keyid 503D4EEE85D18576\n",
      "\tversion 4, created 1691418803, md5len 0, sigclass 0x18\n",
      "\tdigest algo 2, begin of digest 49 87\n",
      "\thashed subpkt 33 len 21 (issuer fpr v4 E51EB50C358F7FD6AFF778E0503D4EEE85D18576)\n",
      "\thashed subpkt 2 len 4 (sig created 2023-08-07)\n",
      "\thashed subpkt 27 len 1 (key flags: 2E)\n",
      "\tsubpkt 16 len 8 (issuer key ID 503D4EEE85D18576)\n",
      "\tsubpkt 32 len 307 (signature: v4, class 0x19, algo 1, digest algo 2)\n",
      "\tdata: [2047 bits]\n"
     ]
    }
   ],
   "source": [
    "!gpg --list-packets publickey-sha1.asc | tee publickey-sha1-packets.txt"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "35ab7cae-d288-4bca-af95-9ff15c26bbbe",
   "metadata": {},
   "source": [
    "Notice that each signature packet has `digest algo 2`, indicating that SHA1 is used."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "dbb95bea-f32e-4c93-8f81-c63fb2fe69e6",
   "metadata": {},
   "source": [
    "#### Edit to trigger new self signatures"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3c77e5de-b877-4313-96a8-07e7ad065dd5",
   "metadata": {},
   "source": [
    "GnuPG won't let you manually add a self signature to a key that already has a self signature, but some changes to the key will trigger it to automatically generate new self signatures.\n",
    "\n",
    "This is usually an interactive process. It's automated below using `expect`.\n",
    "\n",
    "The changes are:\n",
    "- Set updated algorithm preferences (to update the primary key's signature)\n",
    "- Set an unchanged subkey expiry (to update the subkey's signature)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "id": "890243ab-56c5-43f3-9318-ee389de491ce",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "spawn gpg --pinentry-mode=loopback --passphrase some-passphrase --edit-key keymaster@example.com\n",
      "gpg (GnuPG) 2.2.41; Copyright (C) 2022 g10 Code GmbH\n",
      "This is free software: you are free to change and redistribute it.\n",
      "There is NO WARRANTY, to the extent permitted by law.\n",
      "\n",
      "Secret key is available.\n",
      "\n",
      "gpg: checking the trustdb\n",
      "gpg: marginals needed: 3  completes needed: 1  trust model: pgp\n",
      "gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u\n",
      "sec  rsa2048/0x503D4EEE85D18576\n",
      "     created: 2023-08-07  expires: never       usage: SCEA\n",
      "     trust: ultimate      validity: ultimate\n",
      "ssb  rsa2048/0xF21B1176DBB44885\n",
      "     created: 2023-08-07  expires: never       usage: SEA \n",
      "[ultimate] (1). My Name (Some Comment) <keymaster@example.com>\n",
      "\n",
      "\u001b[?2004hgpg> setpref SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed\n",
      "Set preference list to:\n",
      "     Cipher: AES256, AES192, AES, CAST5, 3DES\n",
      "     AEAD: \n",
      "     Digest: SHA512, SHA384, SHA256, SHA224, SHA1\n",
      "     Compression: ZLIB, BZIP2, ZIP, Uncompressed\n",
      "     Features: MDC, AEAD, Keyserver no-modify\n",
      "\u001b[?2004hReally update the preferences? (y/N) y\n",
      "\u001b[?2004l\n",
      "sec  rsa2048/0x503D4EEE85D18576\n",
      "     created: 2023-08-07  expires: never       usage: SCEA\n",
      "     trust: ultimate      validity: ultimate\n",
      "ssb  rsa2048/0xF21B1176DBB44885\n",
      "     created: 2023-08-07  expires: never       usage: SEA \n",
      "[ultimate] (1). My Name (Some Comment) <keymaster@example.com>\n",
      "\n",
      "\u001b[?2004hgpg> key 1\n",
      "\u001b[?2004l\n",
      "sec  rsa2048/0x503D4EEE85D18576\n",
      "     created: 2023-08-07  expires: never       usage: SCEA\n",
      "     trust: ultimate      validity: ultimate\n",
      "ssb* rsa2048/0xF21B1176DBB44885\n",
      "     created: 2023-08-07  expires: never       usage: SEA \n",
      "[ultimate] (1). My Name (Some Comment) <keymaster@example.com>\n",
      "\n",
      "\u001b[?2004hgpg> expire\n",
      "Changing expiration time for a subkey.\n",
      "Please specify how long the key should be valid.\n",
      "         0 = key does not expire\n",
      "      <n>  = key expires in n days\n",
      "      <n>w = key expires in n weeks\n",
      "      <n>m = key expires in n months\n",
      "      <n>y = key expires in n years\n",
      "\u001b[?2004hKey is valid for? (0) 0\n",
      "Key does not expire at all\n",
      "\u001b[?2004hIs this correct? (y/N) y\n",
      "\u001b[?2004l\n",
      "sec  rsa2048/0x503D4EEE85D18576\n",
      "     created: 2023-08-07  expires: never       usage: SCEA\n",
      "     trust: ultimate      validity: ultimate\n",
      "ssb* rsa2048/0xF21B1176DBB44885\n",
      "     created: 2023-08-07  expires: never       usage: SEA \n",
      "[ultimate] (1). My Name (Some Comment) <keymaster@example.com>\n",
      "\n",
      "\u001b[?2004hgpg> save\n",
      "\u001b[?2004l\r"
     ]
    }
   ],
   "source": [
    "!echo -e '\\\n",
    "#!/usr/bin/expect -f\\n\\\n",
    "set timeout -1\\n\\\n",
    "spawn gpg --pinentry-mode=loopback --passphrase \"some-passphrase\" --edit-key keymaster@example.com\\n\\\n",
    "expect \"gpg> \"\\n\\\n",
    "send -- \"setpref SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed\\\\r\"\\n\\\n",
    "expect \"Really update the preferences? (y/N) \"\\n\\\n",
    "send -- \"y\\\\r\"\\n\\\n",
    "expect \"gpg> \"\\n\\\n",
    "send -- \"key 1\\r\"\\n\\\n",
    "expect \"gpg> \"\\n\\\n",
    "send -- \"expire\\\\r\"\\n\\\n",
    "expect \"Key is valid for? (0) \"\\n\\\n",
    "send -- \"0\\\\r\"\\n\\\n",
    "expect \"Is this correct? (y/N) \"\\n\\\n",
    "send -- \"y\\\\r\"\\n\\\n",
    "expect \"gpg> \"\\n\\\n",
    "send -- \"save\\\\r\"\\n\\\n",
    "expect eof\\n\\\n",
    "' | expect -f -"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7f417ede-5abc-47ec-9be8-6461c7886117",
   "metadata": {},
   "source": [
    "Now we can export and examine the updated key."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "id": "3665f2a2-4c5f-4f25-b5c8-11198221935e",
   "metadata": {},
   "outputs": [],
   "source": [
    "!gpg --armor --export keymaster@example.com > publickey-sha512.asc"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "id": "0e654705-a062-4b2e-a5db-5bef55bd2360",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "pub   rsa2048/0x503D4EEE85D18576 2023-08-07 [SCEA]\n",
      "      Key fingerprint = E51E B50C 358F 7FD6 AFF7  78E0 503D 4EEE 85D1 8576\n",
      "uid                             My Name (Some Comment) <keymaster@example.com>\n",
      "sub   rsa2048/0xF21B1176DBB44885 2023-08-07 [SEA]\n",
      "      Key fingerprint = 23F7 B353 929D 7658 5D35  1C12 F21B 1176 DBB4 4885\n"
     ]
    }
   ],
   "source": [
    "!gpg --with-fingerprint publickey-sha512.asc 2>/dev/null | tee publickey-sha512-fingerprints.txt"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "id": "2a297bf9-90b9-4f33-ad28-eddf450d5164",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "# off=0 ctb=99 tag=6 hlen=3 plen=269\n",
      ":public key packet:\n",
      "\tversion 4, algo 1, created 1691418803, expires 0\n",
      "\tpkey[0]: [2048 bits]\n",
      "\tpkey[1]: [17 bits]\n",
      "\tkeyid: 503D4EEE85D18576\n",
      "# off=272 ctb=b4 tag=13 hlen=2 plen=46\n",
      ":user ID packet: \"My Name (Some Comment) <keymaster@example.com>\"\n",
      "# off=320 ctb=89 tag=2 hlen=3 plen=334\n",
      ":signature packet: algo 1, keyid 503D4EEE85D18576\n",
      "\tversion 4, created 1691419540, md5len 0, sigclass 0x13\n",
      "\tdigest algo 10, begin of digest ec 2c\n",
      "\thashed subpkt 27 len 1 (key flags: 2F)\n",
      "\thashed subpkt 30 len 1 (features: 01)\n",
      "\thashed subpkt 23 len 1 (keyserver preferences: 80)\n",
      "\thashed subpkt 33 len 21 (issuer fpr v4 E51EB50C358F7FD6AFF778E0503D4EEE85D18576)\n",
      "\thashed subpkt 2 len 4 (sig created 2023-08-07)\n",
      "\thashed subpkt 11 len 4 (pref-sym-algos: 9 8 7 3)\n",
      "\thashed subpkt 21 len 4 (pref-hash-algos: 10 9 8 11)\n",
      "\thashed subpkt 22 len 4 (pref-zip-algos: 2 3 1 0)\n",
      "\tsubpkt 16 len 8 (issuer key ID 503D4EEE85D18576)\n",
      "\tdata: [2048 bits]\n",
      "# off=657 ctb=b9 tag=14 hlen=3 plen=269\n",
      ":public sub key packet:\n",
      "\tversion 4, algo 1, created 1691418803, expires 0\n",
      "\tpkey[0]: [2048 bits]\n",
      "\tpkey[1]: [17 bits]\n",
      "\tkeyid: F21B1176DBB44885\n",
      "# off=929 ctb=89 tag=2 hlen=3 plen=620\n",
      ":signature packet: algo 1, keyid 503D4EEE85D18576\n",
      "\tversion 4, created 1691419540, md5len 0, sigclass 0x18\n",
      "\tdigest algo 10, begin of digest 85 c6\n",
      "\thashed subpkt 27 len 1 (key flags: 2E)\n",
      "\thashed subpkt 33 len 21 (issuer fpr v4 E51EB50C358F7FD6AFF778E0503D4EEE85D18576)\n",
      "\thashed subpkt 2 len 4 (sig created 2023-08-07)\n",
      "\tsubpkt 32 len 307 (signature: v4, class 0x19, algo 1, digest algo 2)\n",
      "\tsubpkt 16 len 8 (issuer key ID 503D4EEE85D18576)\n",
      "\tdata: [2047 bits]\n"
     ]
    }
   ],
   "source": [
    "!gpg --list-packets publickey-sha512.asc | tee publickey-sha512-packets.txt"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d1967b62-331a-47b7-baf3-93bfb5ca5939",
   "metadata": {},
   "source": [
    "Note that `digest algo 10` (SHA512) is used for each signature. There is mention of `digest algo 2` later in the subkey information, but we will verify that this doesn't prevent successful key import."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8655b899-662f-49f8-b792-9a1bb330aa17",
   "metadata": {},
   "source": [
    "#### Verify that the signatures have changed and key IDs and fingerprints have not changed"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "409fb72e-0b67-46a3-9167-f9cd0e565ec7",
   "metadata": {},
   "source": [
    "Let's compare the packet data from the initial version of the key with the updated version:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "id": "fdc16b51-9499-4721-ae6a-f63648c6f304",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[1;37m--- publickey-sha1-packets.txt\t2023-08-07 16:33:47.656839137 +0200\u001b[0;0m\n",
      "\u001b[1;37m+++ publickey-sha512-packets.txt\t2023-08-07 16:46:36.120187016 +0200\u001b[0;0m\n",
      "\u001b[0;36m@@ -1,38 +1,38 @@\u001b[0;0m\n",
      " # off=0 ctb=99 tag=6 hlen=3 plen=269\u001b[0;0m\n",
      " :public key packet:\u001b[0;0m\n",
      " \tversion 4, algo 1, created 1691418803, expires 0\u001b[0;0m\n",
      " \tpkey[0]: [2048 bits]\u001b[0;0m\n",
      " \tpkey[1]: [17 bits]\u001b[0;0m\n",
      " \tkeyid: 503D4EEE85D18576\u001b[0;0m\n",
      " # off=272 ctb=b4 tag=13 hlen=2 plen=46\u001b[0;0m\n",
      " :user ID packet: \"My Name (Some Comment) <keymaster@example.com>\"\u001b[0;0m\n",
      " # off=320 ctb=89 tag=2 hlen=3 plen=334\u001b[0;0m\n",
      " :signature packet: algo 1, keyid 503D4EEE85D18576\u001b[0;0m\n",
      "\u001b[0;31m-\tversion 4, created 1691418803, md5len 0, sigclass 0x13\u001b[0;0m\n",
      "\u001b[0;31m-\tdigest algo 2, begin of digest 34 86\u001b[0;0m\n",
      "\u001b[0;31m-\thashed subpkt 33 len 21 (issuer fpr v4 E51EB50C358F7FD6AFF778E0503D4EEE85D18576)\u001b[0;0m\n",
      "\u001b[0;31m-\thashed subpkt 2 len 4 (sig created 2023-08-07)\u001b[0;0m\n",
      "\u001b[0;32m+\tversion 4, created 1691419540, md5len 0, sigclass 0x13\u001b[0;0m\n",
      "\u001b[0;32m+\tdigest algo 10, begin of digest ec 2c\u001b[0;0m\n",
      " \thashed subpkt 27 len 1 (key flags: 2F)\u001b[0;0m\n",
      "\u001b[0;31m-\thashed subpkt 11 len 4 (pref-sym-algos: 9 8 7 2)\u001b[0;0m\n",
      "\u001b[0;31m-\thashed subpkt 21 len 5 (pref-hash-algos: 10 9 8 11 2)\u001b[0;0m\n",
      "\u001b[0;31m-\thashed subpkt 22 len 3 (pref-zip-algos: 2 3 1)\u001b[0;0m\n",
      " \thashed subpkt 30 len 1 (features: 01)\u001b[0;0m\n",
      " \thashed subpkt 23 len 1 (keyserver preferences: 80)\u001b[0;0m\n",
      "\u001b[0;32m+\thashed subpkt 33 len 21 (issuer fpr v4 E51EB50C358F7FD6AFF778E0503D4EEE85D18576)\u001b[0;0m\n",
      "\u001b[0;32m+\thashed subpkt 2 len 4 (sig created 2023-08-07)\u001b[0;0m\n",
      "\u001b[0;32m+\thashed subpkt 11 len 4 (pref-sym-algos: 9 8 7 3)\u001b[0;0m\n",
      "\u001b[0;32m+\thashed subpkt 21 len 4 (pref-hash-algos: 10 9 8 11)\u001b[0;0m\n",
      "\u001b[0;32m+\thashed subpkt 22 len 4 (pref-zip-algos: 2 3 1 0)\u001b[0;0m\n",
      " \tsubpkt 16 len 8 (issuer key ID 503D4EEE85D18576)\u001b[0;0m\n",
      "\u001b[0;31m-\tdata: [2042 bits]\u001b[0;0m\n",
      "\u001b[0;32m+\tdata: [2048 bits]\u001b[0;0m\n",
      " # off=657 ctb=b9 tag=14 hlen=3 plen=269\u001b[0;0m\n",
      " :public sub key packet:\u001b[0;0m\n",
      " \tversion 4, algo 1, created 1691418803, expires 0\u001b[0;0m\n",
      " \tpkey[0]: [2048 bits]\u001b[0;0m\n",
      " \tpkey[1]: [17 bits]\u001b[0;0m\n",
      " \tkeyid: F21B1176DBB44885\u001b[0;0m\n",
      " # off=929 ctb=89 tag=2 hlen=3 plen=620\u001b[0;0m\n",
      " :signature packet: algo 1, keyid 503D4EEE85D18576\u001b[0;0m\n",
      "\u001b[0;31m-\tversion 4, created 1691418803, md5len 0, sigclass 0x18\u001b[0;0m\n",
      "\u001b[0;31m-\tdigest algo 2, begin of digest 49 87\u001b[0;0m\n",
      "\u001b[0;32m+\tversion 4, created 1691419540, md5len 0, sigclass 0x18\u001b[0;0m\n",
      "\u001b[0;32m+\tdigest algo 10, begin of digest 85 c6\u001b[0;0m\n",
      "\u001b[0;32m+\thashed subpkt 27 len 1 (key flags: 2E)\u001b[0;0m\n",
      " \thashed subpkt 33 len 21 (issuer fpr v4 E51EB50C358F7FD6AFF778E0503D4EEE85D18576)\u001b[0;0m\n",
      " \thashed subpkt 2 len 4 (sig created 2023-08-07)\u001b[0;0m\n",
      "\u001b[0;31m-\thashed subpkt 27 len 1 (key flags: 2E)\u001b[0;0m\n",
      "\u001b[0;31m-\tsubpkt 16 len 8 (issuer key ID 503D4EEE85D18576)\u001b[0;0m\n",
      " \tsubpkt 32 len 307 (signature: v4, class 0x19, algo 1, digest algo 2)\u001b[0;0m\n",
      "\u001b[0;32m+\tsubpkt 16 len 8 (issuer key ID 503D4EEE85D18576)\u001b[0;0m\n",
      " \tdata: [2047 bits]\u001b[0;0m\n"
     ]
    }
   ],
   "source": [
    "!colordiff -u99 publickey-sha1-packets.txt publickey-sha512-packets.txt"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f104f569-05c1-4c85-bf2d-1eca50b2747d",
   "metadata": {},
   "source": [
    "Notice that no key IDs have changed. The `pref-hash-algos` no longer includes `2` (SHA1) and signatures now use `digest aglo 10` (SHA512).\n",
    "\n",
    "When we compare the fingerprints, there are no changes:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "id": "fd219d66-d7c1-4ec9-bcf0-15759ce2b98a",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0\n"
     ]
    }
   ],
   "source": [
    "!colordiff -u99 publickey-sha1-fingerprints.txt publickey-sha512-fingerprints.txt | wc -l"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "cacfaf7a-9840-4615-a2db-1a7d08243921",
   "metadata": {},
   "source": [
    "#### Verify the fixed key imports succesfully"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "092471ec-583d-4626-94a3-89dd3e04e8dd",
   "metadata": {},
   "source": [
    "When we attempt to import each version of this key with `rpm`, we see that the SHA1 version fails, and the SHA512 version succeeds:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "id": "8fa2939f-cfd9-4c06-8610-98809ac7e1d7",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "warning: Signature not supported. Hash algorithm SHA1 not available.\n",
      "error: /vagrant/publickey-sha1.asc: key 1 import failed.\n"
     ]
    }
   ],
   "source": [
    "!vagrant ssh -c 'sudo rpm --import /vagrant/publickey-sha1.asc'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 25,
   "id": "dd405939-e1c1-471f-827e-a963de564ae6",
   "metadata": {},
   "outputs": [],
   "source": [
    "!vagrant ssh -c 'sudo rpm --import /vagrant/publickey-sha512.asc'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 26,
   "id": "07eb17eb-adc1-4dfd-9911-9e1282f2bb07",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Red Hat, Inc. (release key 2) <security@redhat.com> public key\n",
      "Red Hat, Inc. (auxiliary key 3) <security@redhat.com> public key\n",
      "Fedora (epel9) <epel@fedoraproject.org> public key\n",
      "My Name (Some Comment) <keymaster@example.com> public key\n"
     ]
    }
   ],
   "source": [
    "!vagrant ssh -c 'rpm -q --queryformat \"%{SUMMARY}\\n\" gpg-pubkey'"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "321223cb-ac57-4ffa-a579-5d352611e4b3",
   "metadata": {},
   "source": [
    "## Clean up"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a715e681-d892-44d0-9f26-4c79deadd687",
   "metadata": {},
   "source": [
    "Delete keys the generated key from the local keyring:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 76,
   "id": "e0d9cdf6-33cf-4ff2-96e8-d685f45177cb",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "gpg: checking the trustdb\n",
      "gpg: marginals needed: 3  completes needed: 1  trust model: pgp\n",
      "gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u\n"
     ]
    }
   ],
   "source": [
    "!fingerprint=`gpg --fingerprint 'keymaster@example.com' | grep fingerprint | head -n1 | cut -d= -f2 | sed 's/ //g'` &&\\\n",
    "gpg --batch --yes --delete-secret-keys $fingerprint &&\\\n",
    "gpg --batch --yes --delete-keys $fingerprint"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 77,
   "id": "164e54f6-5ffd-44ec-9147-3b77854d8f19",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "gpg: checking the trustdb\n",
      "gpg: no ultimately trusted keys found\n",
      "gpg: error reading key: No public key\n"
     ]
    }
   ],
   "source": [
    "!gpg --list-keys 'keymaster@example.com'"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "af981b23-40d9-4c06-ba97-107f5f7534ea",
   "metadata": {},
   "source": [
    "Suspend and destroy the RHEL9 Vagrant machine:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "id": "66769c33-db76-41d5-b399-e951eee84cd1",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[1m==> default: Saving VM state and suspending execution...\u001b[0m\n"
     ]
    }
   ],
   "source": [
    "!vagrant suspend"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 29,
   "id": "cd5688cb-9e47-46f0-a931-4223bd9a1d4b",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[1m==> default: Discarding saved state of VM...\u001b[0m\n",
      "\u001b[1m==> default: Destroying VM and associated drives...\u001b[0m\n"
     ]
    }
   ],
   "source": [
    "!vagrant destroy -f"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7953277c-1c70-4839-80e1-98eaa4db378a",
   "metadata": {},
   "source": [
    "Remove the generated files:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 31,
   "id": "d785f51f-5107-41ef-af0a-3c100e993175",
   "metadata": {},
   "outputs": [],
   "source": [
    "!rm -f \\\n",
    " Vagrantfile\\\n",
    " GPG-KEY-elasticsearch\\\n",
    " key-options.txt\\\n",
    " publickey-sha1.asc\\\n",
    " publickey-sha1-fingerprints.txt\\\n",
    " publickey-sha1-packets.txt\\\n",
    " publickey-sha512.asc\\\n",
    " publickey-sha512-fingerprints.txt\\\n",
    " publickey-sha512-packets.txt"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.11.3"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}