At 12:50 PM 5/16/2011, Robert J. Hansen wrote:
On Mon, 16 May 2011 11:32:15 -0600, Steve Strobel
<steve.stro...@link-comm.com> wrote:
> root:~> gpg --import test-key.gpg
> gpg: key CBF38289 was created 137948617 seconds in the future
> (time warp or clock problem)
This is exactly what it sounds like: according to your certificate, it was
created about five and a half months from now.[1] To GnuPG, that sounds
like something's hinky and it refuses to allow it to be imported. You've
managed to get around it by telling GnuPG, "listen, fine, strip off the
hinky signature: /now/ will you accept it?"
And in that case, sure, GnuPG will: but the consequence of it is you've
got a UID that's missing a signature. Hence, "allow-nonselfsigned-uid"
must be passed on the command line.
Thanks for the tip. Just setting the date on the embedded device
before importing the key made it work without "--allow-non-selfsigned-uid".
That still leaves me without a straightforward solution, though. The
embedded device doesn't have a battery-backed clock and doesn't need
one. It will sometimes have Internet access and could potentially
use NTP when available to set the date. That seems like a lot of
extra complexity just to import a key. The user interface doesn't
make it easy to ask the user for the date. What would the security
implications be of just setting the clock to a fixed future date
before importing the key?
[1] As an undergraduate Prof. Hill once mused to me, "Math is funny. You
tell someone how many seconds are in a year, they forget it immediately.
You tell them that accurate to half a percent there are pi seconds in a
nanocentury and they remember it for life." He was right, I've never
forgotten, and that's made it easy to remember there are 31.4 million (3.14
* 10**7) seconds in a year. 13.8 million / 31.4 million = 137/314 = 0.44
of a year, * 12 = five and a half months, more or less. Not really
relevant to GnuPG, but a handy factoid for timestamp calculations, if you
ever need to do them in a hurry.
That is a great way to remember. Now if remembering names was just as easy...
Thanks again,
Steve
---
Steve Strobel
Link Communications, Inc.
1035 Cerise Rd
Billings, MT 59101-7378
(406) 245-5002 ext 102
(406) 245-4889 (fax)
WWW: http://www.link-comm.com
MailTo:steve.stro...@link-comm.com
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
