Get news? 2011 | 2010 | 2009 | 2008 | 2007 | 2006 | 2005 | 2004 | 2003 | 2002 | 2001 | 2000 | 1999 | 1998 | 1997 | About | Contact Want to help?

Linux-Kongress 2006
13th International Linux System Technology Conference
September 5-8, 2006
Georg-Simon-Ohm-Fachhochschule, Nürnberg, Germany

Home | Program | Abstracts | Fees | Registration | Location & Accomodation | Keysigning Party | Sponsors | Call for Papers

Keysigning party

We will be holding a PGP Key signing party at Linux-Kongress 2006. We have been scheduled to meet at 18:15 on Thursday, September 7, 2006. This will also be a good time to meet some CA-Cert assurers.

The procedure we will use is the following:

People who wish to participate should email an ASCII extract of their PGP public key to keys-lk2006@quux.de by Sunday, September 3, 2006.

Please include a subject line of "LK 2006 PGP KEY", and please do not sign or encrypt your email.

The method of generating the ASCII extract is:

   
        gpg --export -a my_email_address > mykey.asc (GnuPG)
        pgp -kxa my_email_address mykey.asc (pgp 2.6.2)

By Monday, September 4 noon (UTC), you will be able to fetch both the complete key ring with all the keys that were submitted along with a text file giving the fingerprint of each key on the ring.

These files can be found here:

    
http://www.quux.de/lk-2006-keysigning/lk2006.gpg
http://www.quux.de/lk-2006-keysigning/lk2006.txt

At home, verify that the fingerprint of your key in lk2006.txt is correct. Also compute the MD5 and SHA1 hash of lk2006.txt. One way to do this is with md5sum invoked as follows:

   
% md5sum lk2006.txt
% sha1sum lk2006.txt
Just to be sure that you have no problems with the download, the MD5 and SHA1 hash will be published at http://www.quux.de/lk-2006-keysigning/hash.txt. Note, that this is just a hint - you must do the check yourself.

Bring the hash you computed, a hard copy of lk2006.txt (we will provide printouts at the event in case you can't print it out before you leave to Nuremberg), your identity card (Note: CA-Cert requires two IDs) and a pencil to the event.

A reader at the front of the room will recite the MD5 hash of lk2006.txt. Verify that the hash recited matches what you computed. This guarantees that all participants are working from the same list of keys.

In turn, each participant will stand up and acknowledge that the fingerprint of his or her key listed is correct. Mark the key verified on your hard copy using the box with the square brackets. The identity card will also be passed around and you should match the image with the actual person; if they match you should mark that corresponding user ID fields using the box with the round parenthesis.

Later that evening, or perhaps when you get home, you can sign the keys corresponding to the fingerprints which you were able to verify on the hard copy; note that it is advisable that you only sign keys of people when you have personal knowledge that the person who stood up during the reading of his/her fingerprint really is the person which he/she claimed to be. This is the reason we provide the check boxes left to the user IDs.

Note that you don't have to have a laptop with you; if you don't have any locally trusted computing resources during the key signing party, you can make notes on the hard copy, and then take the hard copy home and sign the keys later.

Jens Link, jenslink < at > quux.de


Comments or Questions? Mail to contact@linux-kongress.org Last change: 2006-09-16