[Pkg-gnupg-commit] [gnupg1] 27/35: Release 1.4.21

[Daniel Kahn Gillmor]

This is an automated email from the git hooks/post-receive script.

dkg pushed a commit to branch master
in repository gnupg1.

commit 47531220e57bf5093dcf2312884124f0a79e15db
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Aug 17 15:07:57 2016 +0200

    Release 1.4.21
---
 NEWS   | 11 ++++++++++-
 README | 32 +++++++++++++++++++-------------
 2 files changed, 29 insertions(+), 14 deletions(-)

diff --git a/NEWS b/NEWS
index 7de62d9..9b84c17 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,15 @@
-Noteworthy changes in version 1.4.21 (unreleased)
+Noteworthy changes in version 1.4.21 (2016-08-17)
 -------------------------------------------------
 
+ * Fix critical security bug in the RNG [CVE-2016-6313].  An attacker
+   who obtains 580 bytes from the standard RNG can trivially predict
+   the next 20 bytes of output.  Problem detected by Felix Dörre and
+   Vladimir Klebanov, KIT.
+
+ * Tweak default options for gpgv.
+
+ * By default do not anymore emit the GnuPG version with --armor.
+
 
 Noteworthy changes in version 1.4.20 (2015-12-20)
 -------------------------------------------------
diff --git a/README b/README
index 1a331fb..55b2f03 100644
--- a/README
+++ b/README
@@ -307,6 +307,12 @@
     card.  To see the fingerprints of the secondary keys, you can
     give the command twice; but this is normally not needed.
 
+    NEVER use the keyid to verify a key - always use the complete
+    fingerprint.  The keyid is just a convenience handle to identify a
+    key by a short semi-unique name which is trivial to spoof.  You
+    may want to put the line "keyid-format long" into your gpg.conf to
+    tell gpg to print the long keyid (which is still spoof-able).
+
     If you don't know the owner of the public key you are in trouble.
     Suppose however that friend of yours knows someone who knows someone
     who has met the owner of the public key at some computer conference.
@@ -403,28 +409,28 @@
 
     There are several ways to specify a user ID, here are some examples.
 
-    * Only by the short keyid (prepend a zero if it begins with A..F):
+    * By a fingerprint:
 
-	"234567C4"
-	"0F34E556E"
-	"01347A56A"
-	"0xAB123456
+	"1234343434343434C434343434343434"
+	"123434343434343C3434343434343734349A3434"
+	"0E12343434343434343434EAB3484343434343434"
+
+      The first one is a short fingerprint for PGP 2.x style keys.
+      The others are long fingerprints for OpenPGP keys.
 
-    * By a complete keyid:
+    * By a complete keyid (prepend a zero if it begins with A..F):
 
 	"234AABBCC34567C4"
 	"0F323456784E56EAB"
 	"01AB3FED1347A5612"
 	"0x234AABBCC34567C4"
 
-    * By a fingerprint:
-
-	"1234343434343434C434343434343434"
-	"123434343434343C3434343434343734349A3434"
-	"0E12343434343434343434EAB3484343434343434"
+    * By the short keyid:
 
-      The first one is a short fingerprint for PGP 2.x style keys.
-      The others are long fingerprints for OpenPGP keys.
+	"234567C4"
+	"0F34E556E"
+	"01347A56A"
+	"0xAB123456
 
     * By an exact string:
 

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-gnupg/gnupg1.git