GPG BADSIG ED444FF07D8D0BF6 error on apt-get update

[KALIMERO]

Hi, while updating I get this error:

W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://security.kali.org kali/updates Release: The following signatures were invalid: BADSIG ED444FF07D8D0BF6 Kali Linux Repository <[email protected]>

W: Failed to fetch http://security.kali.org/kali-security/dists/kali/updates/Release  

W: Some index files failed to download. They have been ignored, or old ones used instead.

I tried to import the gpg key like described here and also followed the instructions regarding gpg key import published here. Also an

aptitude reinstall kali-archive-keyring

was not successful, still getting this error on update.

What is going on here? Is this a MIM-attack on network site that tries to inject poisened kali packages on my machine?

Thanks for your attention,
Kalimero

[maverik35]

Try this: aptitude clean and then aptitude autoclean.

Retry: aptitude install kali-archive-keyring

[KALIMERO]

Yes, I did this before, no chance, this error still occurs on every update.

Am I the only one with this error? I can not imagine this error happens only to me.

Could anybody please explain how this error is generated, exactly? What exactly is apt trying to verify? Which file exactly is verified against which key?

I am just trying to understand what exactly goes wrong here and have not enough knowledge about apt-get internals, so some more insight about what exactly the package manager does will help in understanding if the data received on my site really is different from the data offered on the kali servers.

Thank you very much for your attention!

BTW I just see that there is no secure access to http://archive.kali.org/archive-key.asc possible - from my understanding this breaks the whole chain of security that is offered by the combination of cryptographic secured protocols and gpg. The archive-key.asc should be accessible via https - makes no sense that it is not.

[pat_r10t]

I started getting this same error yesterday, in varying flavors.

When doing an apt-get update

Reading package lists... Done
W: GPG error: http://http.kali.org kali Release: The following signatures were invalid: BADSIG ED444FF07D8D0BF6 Kali Linux Repository <[email protected]>

Sometimes

W: Failed to fetch gzip:/var/lib/apt/lists/partial/http.kali.org_kali_dists_kali_main_binary-amd64_Packages  Hash Sum mismatch

W: Failed to fetch gzip:/var/lib/apt/lists/partial/http.kali.org_kali_dists_kali_non-free_binary-i386_Packages  Hash Sum mismatch

E: Some index files failed to download. They have been ignored, or old ones used instead.

Sometimes

W: A error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://http.kali.org kali Release: The following signatures were invalid: BADSIG ED444FF07D8D0BF6 Kali Linux Repository <[email protected]>

W: Failed to fetch http://http.kali.org/kali/dists/kali/Release  

W: Some index files failed to download. They have been ignored, or old ones used instead.

Thought maybe the repos were updating or undergoing some sort of maintenance, but the issue persists today. Have done all the apt-get clean, autoclean, remove, autoremove stuff.

I'm not a crypto guy, and maybe I'm overcautious and skeptical, but getting crypto errors 1 day after GnuTLS vuln was big news, and packages like libgnutls-openssl27 in the update queue, well it doesn't give me a warm and fuzzy.

[pat_r10t]

Did nothing different today, haven't even rebooted, but do not get the GPG errors anymore.