The Eleventh Annual Southern California Linux Expo
February 22-24, 2013
Hilton Los Angeles International Airport
February 22-24, 2013
Hilton Los Angeles International Airport
Where: SCALE 11x, Lower Lobby
When: February 23, 2013, 7pm
What: SCALE PGP Keysigning Party
Over the last two years we put a lot of work into making it easy for anyone to verify fingerprints at any time, and it has been a huge success. This year, we've continued to provide the ability to enter your keys at registration time and we will again print your keys on your badge, but we've improved the input checking to prevent invalid fingerprints, added size and type, and streamlined the forms. We hope to continue to make this easier for everyone!
A keysigning party is a get-together with PGP users for the purpose of meeting other PGP users and signing each other's keys. This helps to extend the "web of trust" to a great degree. Also, it sometimes serves as a forum to discuss strong cryptography and related issues.
For more information the FAQ, see below.
If you already have a key, then the details on what to fill in are listed below. If you do not yet have a key, please see the How do I prepare section.
All you need to fill in on the SCALE registration page is your fingerprint. This can be found in the output of the command gpg --fingerprint youremail@domain.comand looks like 59F6 EF51 D60E 6B62 E5FB 9963 3795 E8C5 A1E7 32BB.
You also must ensure that your keys are available on the SKS Keyservers (of which MIT's keyservers are now part of). You can do this with gpg --keyserver x-hkp://pool.sks-keyservers.net --send-key keyid where keyid is your key ID.
For more details see the How do I prepare section or the FAQ.
If you don't already have keys, follow these instructions, or read the gnupg man page, to create a keypair. If you have any problems, let me know.
When you fill in your fingerprint on the SCALE registration form you are automagically registered!
Run gpg -K --fingerprint <your email> and print the results. Keep this piece of paper secure! At the conference, verify that the fingerprint on your badge is correct. Now yo udon't have to carry anything additional around!
Your fingerprint will be printed on back of your badge, and the front will have a PGP icon to show you are a PGP user. In addition, the PGP worksheets will be available starting at noon on the first day. This means that you can easily verify and be verified whenever it is convenient for you, even if you can't make the party!
Note that all of this will be explained at the party. But you may choose to familiarize yourself with the basic idea.
First, each person will get a piece of paper with the fingerprint of every key that was sent to me, and some checkboxes next to each one.
Then, each person will read off their fingerprint from their own personal copy of their fingerprint that they brough with them from their private key. As they do this, each person will verify that the fingerprint on the list they received is in fact valid.
We then get in a big "conga-line." This involves splitting into two equal lines, and having this lines face each other. You then verify the identity of the person in front of you. This should include seeingofficial identification. How much verification you need to state to the world you believe this person to be the name on their key is up to you. It's common to require two forms of ID at least one of which is picture ID and one of which is government ID.
Once everyone is ready, everyone shifts down one and repeats the process. This whole thing is repeated until everyone had verified everyone. Checkboxes will be provided next to each key on your list to make it easy to keep track of who you have verified.
That's it! Feel free to stick around afterwards and chat with people.
Note this will all be explained at the party as well. It's documented here for reference after the party.
After the party, you return to your workstation and sign and deliver keys. This is quite time-consuming, so set aside some time within a week of the party to do this.
I will send out a keyring with everyone's key to make things a bit easier for everyone. From here you must verify those keys, sign them, and verify email addresses.
The keyring location will be specified here, after the party. Download it to a file. You can either import it into your keyring, or use it with --keyring <file>.
For each key, verify the key you have is the same as the key on the paper you've verified: gpg --fingerprint <key ID>. Verify the full key ID.
In theory, there's a very complicated way to validate email by exchanging numbers and words, and exchanging them in various encrypted emails and such. It's complicated, and if you don't already know about, you probably don't want to do it.
Instead there's an easier (and reasonably secure) way to verify email addresses. However, it entails singing key first, so it's a bit counter-intuitive. The section on signing is below, so we're skipping that bit for the moment and going onto the verification.
Lets first look at the simple case where there's only one UID on a key (and thus one email address). We'll call the person John Doe and their email address will be
After you verify the fingerprint of the key you have and John's identity, you sign john's key, and export the signed key to a file. You then encrypt-email this to them.
You know that John owns that key, so only John can decrypt the message. Only the owner of the email address can (in theory) get that email. Thus only if John owns that email can he get the signature. This method is sufficient for the vast majority of even paranoid PGP users.
Note, however, that if someone has multiple UIDs on a key, this involves the following rather-annoying process:
I have a utility called PIUS to make this somewhat easier. You should see the help or read the docs first, but you probably want something like pius -a -A -r </path/to/party/keyring.gpg> -s <your_keyid> - or, alternatively, if you want pius to handle the encrypt-email portion as well, then add -m <your_email>. There are also a variety of options to tell it how to find your mail server as well.
It's worth noting that PIUS is young, so if you find bugs, let me know.
I recommend using PIUS - it can bring the time to sign 20 keys down from 2 hours to 10 minutes.
If you are not using PIUS, you can sign the key manually as follows gpg --ask-cert-level --sign-key <key ID>.
You will be asked what level you want to sign it at. Level 3 is if you have verified their fingerprint, ID, and email carefully enough that you feel confident stating publicly that you personally vouch for the fact that the person with the name in question owns the key and the email address in question. Level 2 is "casual checking" - perhaps they only had 1 form of ID, or they had 2 IDs that you didn't feel were up-to-snuff, or something else that makes you less than 100% sure. Level 1 is, in many opinions useless, as it says you have done no checking at all. Level 0 is, also useless, as it says you decline to answer (which would probably be better served by adding local trust to the trustdb instead of signing their key).
For every key you sign you will have to select a level and also type in the passphrase to your key (to unencrypt it so it can be used to sign the key in question).
gpg --armor --export you@email.com) to keysigning AT socallinuxexpo DOT org by Feb 21, 2013.
