Preparing for a Key-Signing Party
A keystroke-by-keystroke guide
Charles Shapiro
Gracious Assistance by Judy Thompson
[ed Aaron Ruscetta]
15 Nov 2009
Revised 1 Dec 2021
There are two kinds of cryptography in this world: cryptography that
will stop your kid sister from reading your files, and cryptography
that will stop major governments from reading your files.
Bruce Schneier, Applied Cryptography: Protocols, Algorithms, and Source Code in C, John Wiley and Sons, New York, 1994
Introduction
Modern cryptography involves codes which have separate encryption and
decryption keys. The mathematics involved ensures that it's impossible
to guess one key from the other with current technology. Because the
two keys are separate, it's possible to let any stranger send you a
message which only you can read, or to identify a message's only
possible originator as you. Both of these properties can be very
useful on the internet, where the security of face-to-face interaction
is missing.
This guide will give you step-by-step instructions on how to create
and use a two-part key with gpg (a free and open program), and how to
prepare for a key-signing party. Key-signing parties are important
because they provide the crucial face-to-face interaction you need to
verify that a gpg key belongs to someone; after one meeting, you can
be sure that anything using that key had to come from them. Once you
have successfully attended a key-signing party, you will posess a key
which is indubitably bound to you, and this fact will be easy to
verify for anyone else, even if they were not at the party you attended.
So what is this really good for?
A properly attested GPG key is something which you'll probably seldom use. But,
like a pistol, when you need it, you will really need it. Here are
some scenarios where it might be crucial:
Finding a Job
Some Technical Recruiters can be untrustworthy. They have been known
to alter resumes to make them more attractive to hiring companies,
adding experience or qualifications which applicants lack. This
leads to unhappiness and unwarranted damage to reputations. With
your GPG key, you can sign your resume in such a way that: a) only
you could have signed it and b) any alterations will be
obvious. This protects both honest recruiters and you. A bad
signature check might mean that you won't get that particular job,
but it'll keep your prospective employer from blaming you for lying.
Getting Credentials at your new job
So you have finally landed that dream work-from-home job. Your
excited new employer wants to send you a whole passel of
credentials, access codes, and username/password pairs to let you
into their VPN and their other systems. You can simply give them
your public GPG key ID for this purpose. They can verify that your
key is attested by a bunch of folks (hence, it's clearly really
yours), and they can then use it to send a file which only you can
read. Anyone who intercepts the key ID you send them over email
won't be able to substitute their own key ID since that would
require counterfeiting not only your key, but all of the keys of the
people who attested to it, and potentially the attestations of
those keys. This quickly becomes so difficult that it overshadows
the value of the data they are trying to steal.
I have personally used this method to on-board contractors who lived
in another country, where a personal visit to our offices wasn't possible.
Talking to people in private
The gpg key infrastructure gives you the power to transfer any data
completely privately. Maybe you want to email your wife your bank
information, or discuss pay scales with your co-workers, or transfer
some code you wrote to your own machinery. This technology
lets you do these things safely and discretely,
regardless of the security of your email server, your company
laptop, or any other piece of electronic gear you happen to be using.
As long as a trustworthy copy of gpg is available and you have
access to the correct public keys, you can
encrypt anything you need to so that only you and your friends can read it.
Tasks for the Key-Signing Party, in order
Before the Party
After the Party
First, Catch Your Chicken
In order to make your gpg key, you will need to have the Gnu Privacy
Guard program loaded on your machine. This guide assumes that you
already have this step done. Most modern linux distributions ship with
gpg as part of the base operating system set. If gpg isn't on your
system, you can use your package manager to load it, or download and
build the latest and greatest version from
the Gnu Privacy Guard
website. I also assume that you can get to
a bash command prompt; this guide will tell you how to generate and
publish your gpg key from the command line. I am also assuming that
you're on at least version 2.2.12 of gnu privacy guard. Earlier
versions have a subtle bug which can compromise your security. I explain
that in the Advanced guide If you're using windows, you are pretty much on your own; I
know that gpg exists for those machines, but I've no idea how (or if) it works.
To determine if gpg is properly installed and up-to-date on your machine,
get to a command-line prompt and type in:
gpg --version
gpg should respond with something like:
gpg (GnuPG) 2.2.12
libgcrypt 1.8.4
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Home: /home/devel/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2
Be sure that the "version" is at least 2.2; if not, you should
update your copy of gpg or use a machine with a more up-to-date copy.
Steps to make your gpg key
In this example, I will use the name "Millicent Arondofique" for your name,
and the email address "millicent.arondofique@tomshiro.org" for your email
address. Substitute your information for these as needed. Your real name and
your email address are the only two pieces of information you will need to
create a gpg key.
From the command prompt, type the following:
gpg --full-generate-key
gpg will respond with:
gpg (GnuPG) 2.2.12; Copyright (C) 2018 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Please select what kind of key you want:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)
Your selection? 1
Select "RSA and RSA (default)" (here by pressing "1" and "enter").
gpg will next say:
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (3072)
You can take the default by pressing >enter< here.
Next, gpg will say:
Requested keysize is 3072 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0)
You want to make a permanent key, unless (a) you're very
paranoid or (b) you're making a key for some special purpose which
will expire. To make a permanent key, just press <enter>.
gpg will next give you a chance to go over these steps:
Key does not expire at all
Is this correct? (y/N)
Press "y" and <enter> here.
gpg will respond with:
GnuPG needs to construct a user ID to identify your key.
Followed by a short text form for you to fill out:
Real name: Millicent Arondofique
Email address: millicent.arondofique@tomshiro.org
Comment: Sample Key
It's best to use an email address which you know you will control for a long
time here; a work email, for example, is a Bad Idea. My email address
on a domain I control, which forwards to whatever current email address I
am actually using. A key without a valid email address is far less useful.
After the final prompt, gpg will check that this is really what you want:
You selected this USER-ID:
"Millicent Arondofique Sample Key <{{your real email address}}>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit?
Press the letter "O" and hit <enter> here unless you want to make changes.
gpg will then ask for a passphrase. If you're in a text window on a GUI, this will come up in a separate window; otherwise, it will probably come up right there. gpg passphrases have no length limit. I tend to rely on length more
than Caps and 9umbers, although your mileage may vary here. Substituting
numbers for letters is useless, since most password crackers will crack
common substitutions such as "9" for "N" or "1" for "i" and makes
pass phrases hard to remember. A phrase
or a bit of poetry can work well here. Extra points if it's not in English.
If you lose or forget your
passphrase, you will lose the ability to revoke the key as well as the
ability to use it, so it's important to be able to keep this safe.
After this, gpg will actually generate the key:
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: key E8ED6BCB08FAEDAD4DB0CD116D73AA10D5884111 marked as ultimately trusted
gpg: directory '/home/devel/.gnupg/openpgp-revocs.d' created
gpg: revocation certificate stored as '/home/devel/.gnupg/openpgp-revocs.d/E8ED6BCB08FAEDAD4DB0CD116D73AA10D588411.rev'
public and secret key created and signed.
pub rsa3072 2021-11-30 [SC]
E8ED6BCB08FAEDAD4DB0CD116D73AA10D5884111
uid Millicent Arondofique Sample Key
sub rsa3072 2021-11-30 [E]
The keys are generated in files located in your
"${HOME}/.gnupg". directory. If you look inside that directory,
you'll find a "pubring.gpg" and a "private-keys-v1.d" directory.
This is where the keys you created actually reside. You'll use gpg to manage
and export them from here. Make sure to keep these files backed up or
distributed; if you lose the contents of your "private-keys-v1" directory,
you're basically in the same boat as you are if you forget your passphrase. The
"pubring.gpg" file contains the parts of the key which you'll publish,
so it is marginally less critical -- but you probably want to keep it
backed up as well, because that's where all your friends' public keys
go, and it'll be painful to reconstruct should you lose it.
Testing Your Key
You have now created your gpg key on your local machine. You can test
it with the following commands:
gpg --list-key "Millicent Arondofique" should list the key:
pub rsa3072 2021-11-30 [SC]
E8ED6BCB08FAEDAD4DB0CD116D73AA10D5884111
uid [ultimate] Millicent Arondofique Sample Key
sub rsa3072 2021-11-30 [E]
Note in this listing the big long number just under "rsa3072". This is
your key's identifier, which we will use in the formal setting of the keysigning party to verify that this is indeed your key. The common un-ambiguous way to refer to a gpg key is with a "fingerprint", which is the last 8 digits of this key -- "A4AC 3C50" in this case. You can use this fingerprint to look up a
key on a keyserver, but beware that it is not totally secure. It's easy to
create a key identified by an identifier with the same last 8 digits, and that
in turn is easy to confuse with your real key. Always use full identifiers to
verify a key.
You can list your key locally through its fingerprint:
gpg --list-key --fingerprint D5884111
Which should give you something like:
pub rsa3072 2021-11-30 [SC]
E8ED 6BCB 08FA EDAD 4DB0 CD11 6D73 AA10 D588 4111
uid [ultimate] Millicent Arondofique Sample Key
sub rsa3072 2021-11-30 [E]
Note that the last 8 digits of the full key ID and the fingerprint are the same. You should not use 8-digit key fingerprints in public, however, since with only 32 bits of data they're vulnerable to counterfeiting.
To encrypt a file, use the "encrypt" command on it. Specify your key's fingerprint as the receiver. If you need to
send it through email, the "--armor" option will convert the encrypted
file to an all-ASCII representation. This is slightly bigger but
guaranteed not to be corrupted in transit:
gpg -r A4AC3C50 --armor --encrypt gorey.txt
You can, of course, also use the name:
gpg -r "Millicent Arondofique" --armor --encrypt gorey.txt
And you can specify multiple recipients, as long as they are in your
public keyring:
gpg -r "Millicent Arondofique" -r"Annette Arondofique" --armor --encrypt gorey.txt
In this case you will get a file which Millicent and Annette can read.
This will get you a file with ".asc" appended to its name
("gorey.txt.asc" in the example). The contents should be encrypted; if
you cat(1) it out to the screen, it should look something like this:
-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.9 (GNU/Linux)
hQEMAyH27YShGH15AQf/dT515stF4o4+HOfRCDyKTVyKOKhpPt8BjrMa3076fHzH
jrvRZz2kmzIiJRXmp16SKu4dbtZqdMzF71pDIkE1+PNTTciGLjqWlVnQGnP0qiXy
B0FjW3fdc0P9nFBCKktHMCC5POH7+UE70OE7ko8c7bb0Ac9Z7i9+28kfCFxcQeK7
YuEEy9Twkp8X4yIXzX6JhkfLTsus1Rna9d2r1h2MN1W9DXhA1wmwcwek8SR/yNLR
foY8pjfgraepLG12ZS9MY2uvXoI0hXFL6XgXmBH5SSxvJ9fenqptvbzYqFtzTWOs
/j2axn/9n4jr4fSAtvjCjvExlykNicBAvXQ2HOfCb9LpAbRoSunv8y5cpbQZjQKS
Uqk51FAnwpJ0H1h6uZEO/uZiYtR/Hhg3gpMoy3ITayob6+JW7d7NBTNa0B7Ut+WU
/3FzB0BdUJltIoUOBeeF2STCsPsNVOf4nAx3mgxGo2K/pKKXpOSjeZQbm8WodJa7
+rGPltt2Pegdutvtv3mAXk3QmlbMqm7tZQ1I5MI0KlKe9h0/RhNQjW2Jdp7cz92/
GJHkwSWwOl8Ql9ticf5xK1kN0zfX45hsbK57PMwJmStqbdYSAov8pCUr0OEj5UCs
ZB9zExKEP41p1n3RLdjF2BCi3i6q6nJMdO8mjA9tDGy8cbg/OjA/K00QJXLWvtnT
5Q9dEZaxyzL8TkpGHHFPlT4BXPTc090nnZMpFGLEQ6Y8/z+YBVlPGsty8gBaAWWg
dZb8vJ8C29ycqY++GJ1jkZGs2BuxBti7Stz+ALXg8DlQ0ZAJcfr/MEqAaBCKA25T
BGexkWQ6RaBUKE/DTaNjx2la1+ahleDZUEvZEa/ebs6Jel6MM101MiWzEuRG+3vA
FfY3CVnkNnXLjofJS/KNnl92HZbBFf6s2orVRDeppOaUN5Fyo/d6ZKGmcRxFa/kf
IQXPqIWfRBTPBGqjWvBnKyIc82ay2KZ+CSAcAOTZ4AVQsaYuKGwrxrSKpJ1mYcZ/
ZgbhL/DQ2GisE7fFeBCc4ioziH6M1/390e28cTSY4pFg8yKv4GbYb+X8e8s3DuWH
cYPqLKxV7AvuuWMhSX9QcvQCBW08
=9lFc
-----END PGP MESSAGE-----
You can decrypt the file with the "--decrypt" command:
gpg --decrypt gorey.txt.asc
gpg will ask for your passphrase in a separate window if you're on a
GUI.
When your pass phrase is correctly entered gpg will decrypt the file to
stdout. You should see the original contents of your file on the
screen.
Publishing your Key
In order for your friends to use your key to send you stuff, and in
order for you to be able to prove that you sent something, you must
publish the public part of your key to the world. You do this by
using gpg to upload it to a key server. The interweb contains many key
servers, and they communicate with each other, so it's only necessary
to publish your key once; eventually all the key servers will know
about it. We are using ubuntu's key server ("keyserver.ubuntu.com")
for this party, but many other organizations run keyservers. One of
the most famous is run by MIT ("gpg.mit.edu"). To publish your key,
use gpg as follows (using your key fingerprint, as
explained earlier):
gpg --keyserver keyserver.ubuntu.com --send-keys {{your fingerprint}}
gpg will hold for a little while, then respond with:
gpg: sending key D5884111 to hkp server keyserver.ubuntu.com
At this point you should be able to see your key on the keyserver by
pointing your browser at "https://keyserver.ubuntu.com" and
typing your name into the first box. The key ID search feature appears
slightly broken on ubuntu's site, but usually you can search for a key
by its ID as well by prefixing the ID with "0x". This is only the Public
portion of your key -- the Private portions are on your disk in your
"${HOME}/.gnupg" directory, which you should back up carefully. Losing this
directory is functionally equivalent to forgetting your passphrase.
Sending your Key to the Partymaster
The point of a keysigning party is to get other people to
connect the key you have made to you personally. They do this by
seeing you and the key fingerprint together, then attesting that you
are connected by signing your key (see "Signing a Key", below). To
make it convenient for everyone involved, you must send your key to
the party master, so that he can print out its fingerprint and provide
the key itself to your friends.
I will take care of managing the keys for this party. You will need to
email me your key at charlesshapiro@annuitas.com .
First, you need to export your key in a form which is easily
emailed. Use gpg to do this as follows:
gpg --armor --export "Millicent Arondifique" > /tmp/pubkey.txt
You can check /tmp/pubkey.txt by cat(1) ing it out. It should look
something like this:
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.9 (GNU/Linux)
mQENBEsAFAoBCADQCKADsYZhDm8fFQL/t2b/8BytmgtPvNYeBKUUbz9gxjXIOGNN
5Kw+DyF76ZLF3yiTSek98KuV0dCs6/pO2XOp9GfrDOlIbdIE8CC0kT6iXhF4p96I
6HHw0ykPChlOuMzUE8aHSVGK5ww20t3CzfdIsccNd77eFHnjCDvWxJfdJaqb6H4C
x3Rq/0rywIcrYeNIELNldL6npE9RuAeCujO8/rNHvqbofmWCbz2ouWWkxF1MuZkU
V8tOTmT0MiZDD0QsOFF8o+MnEmMrYytJH8LrpYsQ8kVE+0JpiKhfajk69CM3JjHb
BFsJr8IsghoV3NtqqMpo2gLSvblT8y9x7Bn5ABEBAAGJAU0EIAECADcFAksAKhMw
HQNUaGlzIGlzIGFuIGV4YW1wbGUga2V5IHdpdGggbm8gbGVnaXRpbWF0ZSB1c2Uu
AAoJEG1zqhDViEEROkoIAIxOLIKstWDmKBgLTjraO9QRP2VvMfK/LQ0UXQkGwoYL
1TgQ+38I2/n+HIdApK0kSMQBHNmsL+fWqEZyvPG11vMVJzI9uyy8vm1zWII+QeT3
j3aIQrvsCVg5A7GPvTsTvU1Rl8ANPSVhqwHPjjvJynMgUuyPZin7RBE8d23dB9/K
bZp6VElsa5BsdHyVeESwhHMyd0ryQbGuvx7ZuPvA/euoxPkrCYhkC+2Ced46wigR
0kpC4rWaBU7S+LJqeHcyawcUCn2tbgQUCo4yiT+JOgOadDH1DAPM9jQ5AF0xjg15
wdOLWG3iQVSR8j2p9XQuCK9i2rZjbpBR3fgJy6OxP2W0TE1pbGxpY2VudCBBcm9u
ZG9maXF1ZSAoRXhhbXBsZSBncGcga2V5KSA8bWlsbGljZW50LmFyb25kb2ZpcXVl
QHRvbXNoaXJvLm9yZz6JATYEEwECACAFAksAFAoCGwMGCwkIBwMCBBUCCAMEFgID
AQIeAQIXgAAKCRBtc6oQ1YhBEY3dCACDIUhak8AWaUj3JtdfXYCBi2bZnhOPHbVZ
abPrkKTbOeLdPn6DEACu091h4It6uYYp52OQk8iF2AQBOO3AEDY3ZFk2QNEmrsoo
te7/tuu+DVbfFdUTWRrcPZvk/egBgGVtFf5TnWya8w9wMrU+9rN/RSchiJVNeDXB
vrb17OgMU0kjzDyuQADe57sVUO2VgSRsBWWa/1eqthu0XpFh9hcIY2q3jrsltX+G
7JDc3GW9j93IW/gFYmU3QpaMRZVLOYtyGjlBCedkVK6IKgMqIAnstkOaOgOsFBYl
2wHipez/pv66H9MPKcFKZWSsgiHWP2fqgFci5Yo69eNM7eKUUdS9iEYEEBECAAYF
AksAInEACgkQyTB7how4fUcu2QCfcHkSuoaeYF3G/d70LhQ47C/oyF8AoPfo+u7f
WBQJFReLi2wq69EU4BciuQENBEsAGTwBCACuACNS6W6q1wVkd+IIkRGCYta/9e+s
9wqNceh+d/aQuDW/trBUqd+0ew0if7nAeINBvXCuKjWeb3T/FNIpVuWmN4OocYjs
gxjKtU3aMCM1TQcz+KGCTxqYKUtsWBdvOvG6jqyhYMk3AOfbbrO8mli8LrkSM2Wj
SfNKOuZYpZyJsJRiWDVuAkPmWvLsnY7OFn7lqZtAar+EKi0/oXBmdpIPWqyb8P92
b/wARlHlFZsgTDip9qJYnswPmycCGKdaK+WA6lFNQLh/9U45AFpBG7wgC50BusG6
ASF5aKhot7juWw0TD36rxDHeVp4lZfybJtLeBOPfvCm5QWWw3fF5qzbPABEBAAGJ
AR8EGAECAAkFAksAGTwCGwwACgkQbXOqENWIQRGVTgf8CoMRp8qbnMVgLTsgaswV
ilx+1rZvN0dns7KNTtE0lsiCKeVSIDM7LcmlKFhWO5Fvs09M1f5fsmbRVmExWW/n
Zra0XBRAnSREOoSwpLjllNE/xBxquQQ/aj9azk9jniOMhGZh+OM3YrZKJhtLmEbc
6V4LFKQiP5SKPsK4FVp4pnmq90G/sX13/KgBgc3XHGIp8YNSO3WDSqjZ95sCtT8M
mBDxVog9XTG4P+GDgi2SczA69B0P8piKB+J3x4saxstCrLHrojrUbD+raxj030sU
f6S6qzNjnGnWyluohaVZ4txVX88L3hav24KOZiIxIZaIvpgeTGmcAyd8q/M1UibG
Eg==
=mXNc
-----END PGP PUBLIC KEY BLOCK-----
All you need to do now is email this file to
<charlesshapiro@annuitas.com>, either as part of an email message
or as an attachment to an email message.
I will update the keyring you'll download to sign other
peoples' keys with your public key. This is the end of the tasks you
need to do before the keysigning party.
Getting the keys of the other people in this key-signing party
I will email you a file containing the
public keys of everyone in the key-signing party.
Add them to your keyring with the import command. I'm assuming that you
have downloaded "pubring.gpg" to your /tmp directory here:
gpg --import /tmp/pubring.gpg
This will import the new keys, giving your a short report on what
happened. It will skip any keys already in your keyring (such as
yours) and give you a brief report of its actions at the end:
gpg: Total number processed: 9
gpg: imported: 4 (RSA: 2)
gpg: unchanged: 2
gpg: new user IDs: 15
gpg: new signatures: 464
gpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model
gpg: depth: 0 valid: 4 signed: 20 trust: 0-, 0q, 0n, 0m, 0f, 4u
gpg: depth: 1 valid: 20 signed: 5 trust: 20-, 0q, 0n, 0m, 0f, 0u
Signing a Key
The "Web of Trust" works by having validated key-holders verify that
other key-holders are really connected to their keys
and then signing their keys. Signing a key
technically involves encrypting its checksum with your private encryption key;
that way, anyone can use your public decryption key to decrypt the checksum,
verify that it is indeed the same, and (a since they used your public
decryption key to arrive at it) know that you yourself actually signed the
key ( and thus attested that it is real). gpg handles all this automagically.
You need to
sign the key of everyone you saw with their key at the key-signing
party. If you were there, they will do the same for you, and your key
will also become more trustworthy. To sign a
key on your keyring, use the "sign-key" command:
gpg --sign-key D5884111
gpg will display the key you wish to sign and give an "Are you sure?"
message:
pub 2048R/D5884111 created: 2009-11-15 expires: never usage: SC
trust: ultimate validity: ultimate
sub 2048R/A1187D79 created: 2009-11-15 expires: never usage: E
[ultimate] (1). Millicent Arondofique (Example gpg key)
<millicent.arondofique@tomshiro.org>
pub 2048R/D5884111 created: 2009-11-15 expires: never usage: SC
trust: ultimate validity: ultimate
Primary key fingerprint: E8ED 6BCB 08FA EDAD 4DB0 CD11 6D73 AA10 D588 4111
Millicent Arondofique (Example gpg key)
<millicent.arondofique@tomshiro.org>
Are you sure that you want to sign this key with your
key "Charles Shapiro (correct email address)
<charles.shapiro@tomshiro.org>" (8C387D47)
Really sign? (y/N)
You can verify the fingerprint of the key you're about to sign with
the paper you brought back from the party. If they match,say "y" here,
and gpg will ask for your passphrase:
You need a passphrase to unlock the secret key for
user: "Charles Shapiro (correct email address)
<charles.shapiro@tomshiro.org>"
1024-bit DSA key, ID 8C387D47, created 2003-01-30
Enter passphrase:
If you enter the correct passphrase, gpg will sign the key and exit.
You can now see the signature if you list the key with the "list-sigs" command:
gpg --list-sigs D5884111
pub 2048R/D5884111 2009-11-15
uid Millicent Arondofique (Example gpg key) <millicent.arondofique@tomshiro.org>
sig 3 D5884111 2009-11-15 Millicent Arondofique (Example gpg key) <millicent.arondofique@tomshiro.org>
sig 8C387D47 2009-11-15 Charles Shapiro (correct email address) <charles.shapiro@tomshiro.org>
To update the key server with your new key signature, simply send the
signed key to it:
gpg --keyserver keyserver.ubuntu.com --send-keys D5884111
After a short time, you should be able to search the key server for
the key you signed and see your signature on it.
Revoking a Key
You cannot remove a key from the network of key servers. Under some
circumstances (for example, making an example key which will never be
legitimate), you will want to mark your gpg key as unusable on the
servers.
Start by using the "gen-revoke" command to make a "revocation certificate":
gpg --gen-revoke D5884111
sec 2048R/D5884111 2009-11-15 Millicent Arondofique (Example gpg key)
<millicent.arondofique@tomshiro.org>
Create a revocation certificate for this key? (y/N)
Press "y", and gpg will respond with:
Please select the reason for the revocation:
0 = No reason specified
1 = Key has been compromised
2 = Key is superseded
3 = Key is no longer used
Q = Cancel
(Probably you want to select 1 here)
Your decision? 3
Next, you will get a chance to enter a comment:
Enter an optional description; end it with an empty line:
> This is an example key with no legitimate use.
>
Next, you'll get a "go back" dialogue:
Reason for revocation: Key is no longer used
This is an example key with no legitimate use.
Is this okay? (y/N)
Press "y" and <enter> here, and gpg will prompt for the key's
passphrase. Get that right and you'll see:
You need a passphrase to unlock the secret key for user:
"Millicent Arondofique (Example gpg key) <millicent.arondofique@tomshiro.org>"
2048-bit RSA key, ID D5884111, created 2009-11-15
ASCII armored output forced.
Revocation certificate created.
Please move it to a medium which you can hide away; if Mallory gets
access to this certificate he can use it to make your key unusable.
It is smart to print this certificate and store it away, just in case
your media become unreadable. But have some caution: The print
system of your machine might store the data and make it available
to others!
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: A revocation certificate should follow
iQFNBCABAgA3BQJLACoTMB0DVGhpcyBpcyBhbiBleGFtcGxlIGtleSB3aXRoIG5v
IGxlZ2l0aW1hdGUgdXNlLgAKCRBtc6oQ1YhBETpKCACMTiyCrLVg5igYC0462jvU
ET9lbzHyvy0NFF0JBsKGC9U4EPt/CNv5/hyHQKStJEjEARzZrC/n1qhGcrzxtdbz
FScyPbssvL5tc1iCPkHk9492iEK77AlYOQOxj707E71NUZfADT0lYasBz447ycpz
IFLsj2Yp+0QRPHdt3Qffym2aelRJbGuQbHR8lXhEsIRzMndK8kGxrr8e2bj7wP3r
qMT5KwmIZAvtgnneOsIoEdJKQuK1mgVO0viyanh3MmsHFAp9rW4EFAqOMok/iToD
mnQx9QwDzPY0OQBdMY4NecHTi1ht4kFUkfI9qfV0LgivYtq2Y26QUd34CcujsT9l
=4wK2
-----END PGP PUBLIC KEY BLOCK-----
!:/tmp>
Use <copy> to put this into a text file, beginning with the
-----BEGIN and ending with the BLOCK-----
Import this revocation into your local keyring:
gpg --armor --import millicent.revoke
gpg: key D5884111: "Millicent Arondofique (Example gpg key)
<millicent.arondofique@tomshiro.org>" revocation certificate imported
gpg: Total number processed: 1
gpg: new key revocations: 1
gpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model
gpg: depth: 0 valid: 4 signed: 20 trust: 0-, 0q, 0n, 0m, 0f, 4u
gpg: depth: 1 valid: 20 signed: 5 trust: 20-, 0q, 0n, 0m, 0f, 0u
If the import was successful, you can update your key server with the
revoked key:
gpg --keyserver keyserver.ubuntu.com --send-key D5884111
If you search for the key, you should now see an indication that it
has been revoked:
sig revok D5884111 2009-11-15 __________ __________ [selfsig]
Chicken Soup for Your Security
As a group, most of the members of ALE would strongly agree that GPG
is an extremely valuable resource for enhancing the security of your
data, as well as protecting both your identity and your civil liberties
in a world that is increasingly driven by computers and information
technology. We hope the detailed directions above have made it
easier for you to understand the processes of generating, storing,
signing, registering and using GPG keys, and have served to
encourage you to create a personal GPG key and participate in this
Key Signing party.
This work is licensed under a Creative Commons Attribution 4.0 International License.