Ten Steps for attending a keysigning party
7 September 2007
A key signing party can be an event of its own, or it might be at a user group meeting, or at a conference, or at a workplace. The idea is to increase the 'web of trust' and thus strengthen the system as a whole, as well as making your own key more trusted. Alex Willmer explains what you need to do to participate in a key signing party, using GNU Privacy Guard.
You can use either the command line gpg tool or a GUI front end such as seahorse. The command line approach goes as follows:
0. Generate a key
If you've not already done so, generate a key pair:
$ gpg --gen-key
1. Get your key ID
Find your public key, by typing this:
$ gpg --list-keys
This gives the results as below, the uid should match your name and chosen email address. Note the id, on the line labelled 'pub':
> /home/alex/.gnupg/pubring.gpg
-----------------------------
pub 1024D/5A6F95BE 2007-02-08
uid Alex Willmer <alex at moreati.org.uk>
sub 2048g/63329941 2007-02-08
2. Upload your key
Publish your public key to a keyserver, use the keyserver option:
$ gpg --keyserver ldap://keyserver.pgp.com --send-keys 5A6F95BE
Which should respond as follows:
> gpg: sending key 5A6F95BE to ldap server keyserver.pgp.com
3. Print your key fingerprint
Type the following, using the id from step 1.
$ gpg --fingerprint 5A6F95BE
The result is your keyfingerprint of your public key, as shown below.
> pub 1024D/5A6F95BE 2007-02-08
Key fingerprint = C9CD 3335 C138 7291 2022 F30D 2E51 C57B 5A6F 95BE
uid Alex Willmer <alex at moreati.org.uk>
sub 2048g/63329941 2007-02-08
Print your fingerprint onto paper, you should be able to get quite a few on a page, which you can then cut into slips. This also may be achieved with the command gpg-key2ps.
4. Go to the party!
Bring the slips and credentials that prove your identity to the key signing party. Normally parties require you to bring credentials that include a photo (e.g. your passport or drivers licence).
5. Give out slips
Give a fingerprint slip to anybody you wish to sign your key, and allow them to verify your identity using your credentials.
6. Take slips
Verify in person, the identity of anybody you accept a slip from. Ensure the slip has a uid matching their name.
Note that it is anti-social to take slips and just throw them away or forget about them. If you take a slip from someone then it is polite to actually use it by doing steps 7+8.
7. Verify the key fingerprints of your acquaintances
Once home, using the id from each slip, download and verify the fingerprint of each person's key:
$ gpg --keyserver ldap://keyserver.pgp.com --recv-keys [key_id]
$ gpg --fingerprint [key_id]
8. Upload your acquaintances' keys
Sign each of the verified keys, upload them to a keyserver:
$ gpg --sign-key [key_id]
$ gpg --keyserver ldap://keyserver.pgp.com --send-key [key_id]
9. Use GPG!
You can now sign emails and anybody who signed your key can verify that email was sent by you and has not been modified. Additionally, you can encrypt anything you send to a person whose key you have signed.
10. Advanced usage
There are optional, additional steps such as encrypting a signed key and sending it to the listed uid. By receiving the signed key and decrypting it, they prove access to the email address and control of the private key.
More Information
1 Alex Willmer says...
Hi Zeth,
Thankyou for putting the guide up and doing a cleanup. Just one quibble: my key 1024D/5A6F95BE goes with the email address <alex@moreati.org.uk>. I'm not sure what alex at commandline.org.uk is.
Feel free to include my address as is, I try to avoid armouring. I quite like Seahorse, the default Gnome keyring manager myself, which can do all of the above. I'm more of a command line tourist.
Regards, Alex
PS I realise it's bad form not to sign this comment. Sorry.
Posted at 12:50 p.m. on September 24, 2007
2 Mr Stuff says...
It seems I can't convince a single person to use GPG for anything at all! Whenever I recommend it to someone and offer to help them through it step by step, these otherwise intelligent people just turn into morons! It's such a shame. GPG is very fit for purpose and EASY TO USE.
Posted at 7 p.m. on December 16, 2007