Ubuntu Fredericton Key Signing Meeting

[Bob Jonkman]

This is what Joel Goguen <jgoguen at jgoguen.ca> said
about "Ubuntu Fredericton Key Signing Meeting" on 4 Jan 2008 at 21:03

> Please ensure that you bring a government-issued
> photo ID 

Please forgive me for being pedantic for a few moments...

Government-issued ID isn't necessary for a key-signing, and some would even say it's 
undesireable.

The purpose of key-signing is to establish a web of trust, independent of a hierarchical 
Certificate Authority.  By requiring government-issued ID you're essentially making the 
government into a Certificate Authority at the top of the hierarchy.  

Allowing government-issued ID to substitute for your actual knowledge of the identity of the 
person holding the key you're signing makes the government a proxy for your trust.  By 
signing a key based on government ID you're saying "I believe this key belongs to the person  
the government trusts to be Bob Jonkman" or  "I believe this key belongs to a person who is 
licensed to drive a car" rather than "I believe this key belongs to Bob Jonkman".  

There are MANY keysigning "Howto" pages on the Internet that make the same mistake.

Trust should be based on personal knowledge that the key you're signing is associated with 
the person who holds the key.  Note that the actual name of the person isn't really important 
-- pseudonymous keys still allow secure and non-repudiable transactions.  By signing a 
pseudonymous key you're verifying that the person you met is the person who signed today's e-
mail and is the same person who signed yesterday's e-mail.  

Pseudonymous keys are also used for corporate keys that are not tied to a particular person, 
or keys that are associated with a process or an event.  The Toronto Cypherpunks used to 
create a new key for every keysigning party, which was used to sign the keys of the 
participants.  That would provide evidence that a key was signed at a particular party.  
Participants also signed the keyparty key, completing the web of trust.  See 
http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x44CE7F46 for an example.

A keysigning party that doesn't depend on third-party ID does require a good bit of 
preparation: 

1. All participants submit their public keys to the party organizer.

2. The party organizer gathers the submitted keys into a party keyring and publicly posts 
it.[1]

3. All participants download the party keyring and print it out, complete with key 
fingerprints.

4. All participants print copies of their own signed public keys, with fingerprints (and 
optionally, a picture and/or signature) [2]

5. At the party the participants distribute their printed keys to the other participants. [3]

6. Back at home, each participant compares the distributed key fingerprints from other 
participants with those on the party keyring.

7. Participants import verified keys into their own keyrings and sign them.

8. Participants upload signed keys to a keyserver.

9. When all participants have uploaded their keys, they download the same keys to gather all 
the signatures from the keyparty.


[1] The party organizer can create a new party key and add it to the keyring.  The party key 
becomes just another participant.  When all keys have been signed the party key is revoked, 
providing one-time proof of attendance at this particular keysigning party.

[2] I initial each of my printed keys right through the text of the fingerprint.  This 
provides proof to me if someone asks me if a particular printout is mine.

[3]  Optionally, the key fingerprints can be read aloud from the printed party keyring, and 
each participant acknowledges that his key has been read correctly.  This establishes a 
"meatspace" identity for each key.  Optionally, another participant can vouch for the 
identity of the key owner.  That's how the Web of Trust works...


This is mostly well described at http://www3.ietf.org/proceedings/05aug/PGPKeySigning.txt


OK, enough of this.  Pendantry off.  Thank you for your indulgence.



-- -- -- --
Bob Jonkman <bjonkman at sobac.com>         http://sobac.com/sobac/    
SOBAC Microcomputer Services              Voice: +1-519-669-0388       
6 James Street, Elmira ON  Canada  N3B 1L5  Cel: +1-519-635-9413
Networking   --   Office & Business Automation   --   Consulting