Original report dated 2026-07-31:

GnuPG's TOFU trust model treats a key as fully trusted on an unverified user-id certification, so a forged certification carrying an ultimately trusted key's key ID grants full trust

Under the tofu and tofu+pgp trust models, GnuPG upgrades a key/user-id binding straight to TOFU_POLICY_GOOD (which maps to TRUST_FULLY) whenever signed_by_utk() reports that a user-id certification on the key was made by one of the user's ultimately trusted keys. signed_by_utk() decides that solely from the certification's 64-bit issuer key ID (tdb_keyid_is_utk (sig->keyid)); it never calls check_key_signature, so it never verifies the certification is cryptographically valid. The issuer key ID of an OpenPGP signature is an unauthenticated field an attacker sets freely. An attacker can therefore forge a user-id certification packet on their own key, stamp a victim's ultimately-trusted-key key ID into it over a garbage signature, and distribute the key; when a TOFU user imports it, gpg reports the binding as fully trusted. This is a trust-model bypass: forging trust from a cryptographically invalid certification defeats the integrity guarantee TOFU is relied upon to provide.

Reported-by: arthur.chan@adalogics.com
Other-info: ANT-2026-0NGQ3EZK