[Cryptography] DDoS'ing PGP keys

[John Levine]

In article <CABrRNSX8P_81cd2cFoKW7H-OYRv0Kbd3HCMX_eQrRCUooqRK0w at mail.gmail.com> you write:
>-=-=-=-=-=-
>-=-=-=-=-=-
>
>Not sure if this has come up for discussion here before.
>
>https://www.vice.com/en_us/article/8xzj45/someone-is-spamming-and-breaking-a-core-component-of-pgps-ecosystem

As I understand it, the attack simply involves adding thousands of
junk signatures to a key and uploading it to an SKS server.

GPG croaks when it tries to process the key.  I can understand why
that might have been a problem in 1990 when a megabyte was a lot of
memory, but now that the minimal increment is a gigabyte, it suggests
unfortunate things about GPG's testing and code quality.

There's apparently a separate issue that the SKS software is 15 year
old abandonware written in boutique language OCaml, and there's nobody
around (including the original author) with the time and skill to
change it to defend against the junk signatures.