Keysigning 2008
From LinuxTag Public Wiki
(Difference between revisions)
| Line 1: | Line 1: | ||
| - | + | :Kultiges Zusammensitzen und gemeinsames Murmeln magischer Zahlen. | |
| + | :-- Gert Döring, FdI 95 | ||
| - | + | At LinuxTag in Berlin there will be an OpenPGP (pgp/gpg) keysigning party.<br /> | |
| + | The party will be on '''Friday, May 30th, at 14:00 (sharp), Workshop-Room 1'''.<br /> | ||
| + | This event is organized by [mailto:strengATftbfs.de Karlheinz Geyer]. | ||
| - | + | __TOC__ | |
| - | + | ||
| - | === | + | === What is/why keysigning? === |
| - | + | Please read section One of the [http://cryptnet.net/fdp/crypto/keysigning_party/en/keysigning_party.html GnuPG Keysigning Party HOWTO]. | |
| - | + | ||
| - | + | ||
| - | + | ||
| - | + | ||
| - | + | ||
| - | + | ||
| - | + | ||
| - | + | ||
| - | + | ||
| - | + | ||
| - | === | + | === How === |
| - | If you | + | The party will be conducted mainly using Len Sassaman's Efficient Group Key Signing Method: |
| - | + | * If you intend to participate please send your key to our keyserver: | |
| + | user@computer > gpg --keyserver hkp://lt2k8-ksp.ftbfs.de --send-key KEYID | ||
| + | : until '''Saturday, May 24th, 2008'''.<br />If your entry is not listed at http://lt2k8-ksp.ftbfs.de/ksp-lt2k8.txt after submission, please send me an [mailto:strengATftbfs.de email]. | ||
| + | * By Tuesday, '''May 27th 2008''', you will be able to fetch both the complete keyring with all the keys that were submitted along with a text file ksp-lt2k8.txt giving the fingerprint of each key on the ring. For downloading the files later please visit our keyserver at http://lt2k8-ksp.ftbfs.de. | ||
| + | * At home, verify that the fingerprint of your key in ksp-lt2k8.txt is correct. Also compute the MD5 and SHA1 hashes of ksp-lt2k8.txt. One way to do this is as follows: | ||
| + | user@computer > md5sum ksp-lt2k8.txt | ||
| + | user@computer > sha1sum ksp-lt2k8.txt | ||
| + | : or | ||
| + | user@computer > gpg --print-md md5 ksp-lt2k8.txt | ||
| + | user@computer > gpg --print-md sha1 ksp-lt2k8.txt | ||
| + | * Use a pen and write these calculated hashes down into the given fields at ksp-lt2k8.txt. You'll find these fields within the top section of the list. | ||
| + | * At LinuxTag, come with the hash you computed and a hardcopy of ksp-lt2k8.txt. | ||
| + | * We will recite than both MD5 and SHA1 hashes of ksp-lt2k8.txt. Verify that the hash recited matches what you computed. This guarantees that all participants own the same list of keys. | ||
| + | * In turn, each participant will stand and acknowledge that the fingerprint of his or her key listed is correct. Mark the key verified on your hardcopy. Since we already ensured that everybody has the same copy a simple statement like "Yes, this information is correct" might be sufficient. | ||
| + | * The next step is to verify each participant's identity by checking his/her passport or similar sort of ID-Card. | ||
| + | * Later when you are back at home, you can sign the keys which you were able to check during the party. After you signed a key send it to its owner together with your signature. Using caff might be of help for you. | ||
| + | * Fairplay please! A keysigningparty is good for meeting others, share interests and have fun. But the major goal behind such an event is to strengthen the so called WEB-OF-TRUST (WoT), thats why we are kindly asking you to finish your signing-work at home not later than '''Monday, September 1st 2008''' | ||
| - | + | === Downloads === | |
| + | Note: These files ARE NOT AVAILABLE YET, please be patient until the | ||
| + | submission deadline has been reached! | ||
| - | + | Files should be ready for downloading from http://lt2k8-ksp.ftbfs.de/ by | |
| - | + | '''Tuesday, May 27th'''. | |
| - | + | ||
| - | + | ||
| - | + | ||
| - | + | Prior to the keysigningparty you should have already downloaded the | |
| - | * | + | following files: |
| - | * | + | * ksp-lt2k8.txt - List of participants |
| + | * ksp-lt2k8.asc - participating keys (Keyring) or | ||
| + | * ksp-lt2k8.asc.bz2 - participating keys (Keyring), compressed using bzip2 | ||
| - | + | === Summary === | |
| + | This is what you have to bring with you: | ||
| + | * A '''printout of ksp-lt2k8.txt''' incl. filled-in MD5 and SHA1 hashes, check that your fingerprint is correct! | ||
| + | * Some sort of a valid(!) governmental issued '''ID-Card''' (passport or similar). | ||
| + | * Think about creating a paper (DIN-A4, landscape) with your own listnumber on it. These papers later visibly held in front of each participant could help saving time during the line-up procedure. People might find there places within the line easier. | ||
| + | |||
| + | If you have questions please do not hesitate to ask Karlheinz. | ||
| + | |||
| + | === Additional Information === | ||
| + | ==== Keyservers ==== | ||
| + | The only keyserver rotation you should use is subkeys.pgp.net or random.sks.keyserver.penguin.de if you insist. Any of the servers in this rotations is fine. | ||
| + | |||
| + | Please do not use other rotations, like keyserver.net or wwwkeys.pgp.net: They all mangle keys in various ways, including but not limited to dropping subkeys, moving binding sigs around between subkeys, duplicating user ids, modifying signature subpackets (dropping non-hashed data), calculating KeyIDs wrong (for v4 RSA keys), rejecting keys with attribute UIDs (such as photo ids), or don't sync with the rest of the network. | ||
| + | |||
| + | Therefore please use '''subkeys.pgp.net'''. It's a good idea to upload your key(s) to this keyserver prior to the keysigningparty, use this to do so: | ||
| + | user@computer > gpg --keyserver subkeys.pgp.net --send-key KEYID | ||
| + | |||
| + | ==== caff ==== | ||
| + | CA Fire and Forget is a script that helps you in keysigning. It takes a list of keyids on the command line, fetches them from a keyserver and calls GnuPG so that you can sign it. It then mails each key to all its | ||
| + | email addresses - only including the one UID that we send to in each mail, pruned from all but self sigs and sigs done by you. | ||
| + | |||
| + | '''Download it:''' caff (Rev. 365 2008-03-05). Homepage: http://pgp-tools.alioth.debian.org/ | ||
| + | |||
| + | If you have Debian you could also install the signing-party package FreeBSD users can install the signing-party port For NetBSD users caff has its own port Depends: gnupg (>= 1.3.92), perl, libgnupg-interface-perl, libmime-perl, libmailtools-perl (>= 1.62) | ||
| + | |||
| + | ==== gpgsigs ==== | ||
| + | |||
| + | Uli Martens wrote a small perl script that, given a key ID and ksp-lt2k8.txt tells you which keys (UIDs) you already signed by annotating the UID with (S). | ||
| + | 153 [ ] Fingerprint OK [ ] ID OK | ||
| + | (S) pub 1024D/52698E9F 2001-11-07 Uli Martens <uli@youam.net> | ||
| + | Key fingerprint = A48F 8894 37A0 FDE9 60D5 212A 2A58 CEAA 5269 8E9F | ||
| + | (S) uid Uli Martens <isax@gmx.de> | ||
| + | ( ) uid Uli Martens <u.martens@youam.com> | ||
| + | (S) uid Uli Martens <u.martens@scientific.de> | ||
| + | |||
| + | '''Download it:'' gpgsigs (Rev. 373 2008-03-16). Homepage: http://svn.debian.org/wsvn/pgp-tools/trunk/gpgsigs/ | ||
| + | |||
| + | It requires perl, gnupg (>=1.2.x) and either Locale::Recode (in Debian Package libintl-perl, in testing and unstable) or recode (Debian Package recode). | ||
Revision as of 16:17, 15 April 2008
- Kultiges Zusammensitzen und gemeinsames Murmeln magischer Zahlen.
- -- Gert Döring, FdI 95
At LinuxTag in Berlin there will be an OpenPGP (pgp/gpg) keysigning party.
The party will be on Friday, May 30th, at 14:00 (sharp), Workshop-Room 1.
This event is organized by Karlheinz Geyer.
Contents |
What is/why keysigning?
Please read section One of the GnuPG Keysigning Party HOWTO.
How
The party will be conducted mainly using Len Sassaman's Efficient Group Key Signing Method:
- If you intend to participate please send your key to our keyserver:
user@computer > gpg --keyserver hkp://lt2k8-ksp.ftbfs.de --send-key KEYID
- until Saturday, May 24th, 2008.
If your entry is not listed at http://lt2k8-ksp.ftbfs.de/ksp-lt2k8.txt after submission, please send me an email.
- By Tuesday, May 27th 2008, you will be able to fetch both the complete keyring with all the keys that were submitted along with a text file ksp-lt2k8.txt giving the fingerprint of each key on the ring. For downloading the files later please visit our keyserver at http://lt2k8-ksp.ftbfs.de.
- At home, verify that the fingerprint of your key in ksp-lt2k8.txt is correct. Also compute the MD5 and SHA1 hashes of ksp-lt2k8.txt. One way to do this is as follows:
user@computer > md5sum ksp-lt2k8.txt user@computer > sha1sum ksp-lt2k8.txt
- or
user@computer > gpg --print-md md5 ksp-lt2k8.txt user@computer > gpg --print-md sha1 ksp-lt2k8.txt
- Use a pen and write these calculated hashes down into the given fields at ksp-lt2k8.txt. You'll find these fields within the top section of the list.
- At LinuxTag, come with the hash you computed and a hardcopy of ksp-lt2k8.txt.
- We will recite than both MD5 and SHA1 hashes of ksp-lt2k8.txt. Verify that the hash recited matches what you computed. This guarantees that all participants own the same list of keys.
- In turn, each participant will stand and acknowledge that the fingerprint of his or her key listed is correct. Mark the key verified on your hardcopy. Since we already ensured that everybody has the same copy a simple statement like "Yes, this information is correct" might be sufficient.
- The next step is to verify each participant's identity by checking his/her passport or similar sort of ID-Card.
- Later when you are back at home, you can sign the keys which you were able to check during the party. After you signed a key send it to its owner together with your signature. Using caff might be of help for you.
- Fairplay please! A keysigningparty is good for meeting others, share interests and have fun. But the major goal behind such an event is to strengthen the so called WEB-OF-TRUST (WoT), thats why we are kindly asking you to finish your signing-work at home not later than Monday, September 1st 2008
Downloads
Note: These files ARE NOT AVAILABLE YET, please be patient until the submission deadline has been reached!
Files should be ready for downloading from http://lt2k8-ksp.ftbfs.de/ by Tuesday, May 27th.
Prior to the keysigningparty you should have already downloaded the following files:
- ksp-lt2k8.txt - List of participants
- ksp-lt2k8.asc - participating keys (Keyring) or
- ksp-lt2k8.asc.bz2 - participating keys (Keyring), compressed using bzip2
Summary
This is what you have to bring with you:
- A printout of ksp-lt2k8.txt incl. filled-in MD5 and SHA1 hashes, check that your fingerprint is correct!
- Some sort of a valid(!) governmental issued ID-Card (passport or similar).
- Think about creating a paper (DIN-A4, landscape) with your own listnumber on it. These papers later visibly held in front of each participant could help saving time during the line-up procedure. People might find there places within the line easier.
If you have questions please do not hesitate to ask Karlheinz.
Additional Information
Keyservers
The only keyserver rotation you should use is subkeys.pgp.net or random.sks.keyserver.penguin.de if you insist. Any of the servers in this rotations is fine.
Please do not use other rotations, like keyserver.net or wwwkeys.pgp.net: They all mangle keys in various ways, including but not limited to dropping subkeys, moving binding sigs around between subkeys, duplicating user ids, modifying signature subpackets (dropping non-hashed data), calculating KeyIDs wrong (for v4 RSA keys), rejecting keys with attribute UIDs (such as photo ids), or don't sync with the rest of the network.
Therefore please use subkeys.pgp.net. It's a good idea to upload your key(s) to this keyserver prior to the keysigningparty, use this to do so:
user@computer > gpg --keyserver subkeys.pgp.net --send-key KEYID
caff
CA Fire and Forget is a script that helps you in keysigning. It takes a list of keyids on the command line, fetches them from a keyserver and calls GnuPG so that you can sign it. It then mails each key to all its email addresses - only including the one UID that we send to in each mail, pruned from all but self sigs and sigs done by you.
Download it: caff (Rev. 365 2008-03-05). Homepage: http://pgp-tools.alioth.debian.org/
If you have Debian you could also install the signing-party package FreeBSD users can install the signing-party port For NetBSD users caff has its own port Depends: gnupg (>= 1.3.92), perl, libgnupg-interface-perl, libmime-perl, libmailtools-perl (>= 1.62)
gpgsigs
Uli Martens wrote a small perl script that, given a key ID and ksp-lt2k8.txt tells you which keys (UIDs) you already signed by annotating the UID with (S).
153 [ ] Fingerprint OK [ ] ID OK
(S) pub 1024D/52698E9F 2001-11-07 Uli Martens <uli@youam.net>
Key fingerprint = A48F 8894 37A0 FDE9 60D5 212A 2A58 CEAA 5269 8E9F
(S) uid Uli Martens <isax@gmx.de>
( ) uid Uli Martens <u.martens@youam.com>
(S) uid Uli Martens <u.martens@scientific.de>
'Download it: gpgsigs (Rev. 373 2008-03-16). Homepage: http://svn.debian.org/wsvn/pgp-tools/trunk/gpgsigs/
It requires perl, gnupg (>=1.2.x) and either Locale::Recode (in Debian Package libintl-perl, in testing and unstable) or recode (Debian Package recode).
