GnuPG signing parties

From YobiWiki
Jump to navigation Jump to search

Notes on signing-parties

Old notes

Pas mal d'infos sur http://skylane.kjsl.com/~jharris/keysigning.html
Ainsi que des exemples d'annonce par Adulau sur http://www.ael.be/action/gnupg/ et http://www.ael.be/action/gnupg/fosdem/
Mais un problème courant est la coordination physique des gens pour que chacun rencontre chacun.

Before the party

There are some useful tools in Debian: 

apt-get install signing-party

Here is an example based on my participation to the keysigning-party of FOSDEM 2008

  • Importing keys: the organizer provided a file with all the keys exported
tar xzvf keys.tgz
for i in keys/*; do gpg --import $i;done
  • Preparing the given list of keys: the organizer provided a list such as in the examples provided here: /usr/share/doc/signing-party/gpgsigs/examples/. To prepare that file, compute its checksums and add the pictures when possible:
gpgsigs --latex 9ad7e3db ksp-fosdem2008.txt ksp-fosdem2008
latex ksp-fosdem2008
dvips ksp-fosdem2008.dvi
ps2pdf ksp-fosdem2008.ps > ksp-fosdem2008.pdf
  • Preparing a stock of our own fingerprints, in case of...
gpg-key2ps 9ad7e3db |ps2pdf - 9ad7e3db.pdf
  • But after all how was produced the list of fingerprints from the organizer? I created a script to generate such list: (proposed at Debian)
#!/bin/bash

# License: GPLv3
# Copyright Philippe Teuwen <phil a teuwen o org> 2008
if [[ $# -ne 5 ]]; then
    cat <<EOF
Usage: $0 input output datestring organizer title
Or:    $0 -     output datestring organizer title
       to read from STDIN
Example:
       echo 9AD7E3DB 54C12701 |\\
       $0 - ksp-file.txt "20080222 1100" "Philippe Teuwen <phil a teuwen o org>" "my party 08"
EOF
    exit 0
fi

input="$1"
[ "$input" == "-" ] && input="";
output="$2"
date="$3"
org="$4"
title=$(echo "$5"|tr a-z A-Z|sed 's/\(.\)/\1 /g')

exec > "$output"

# Date of event
LANG=C date --date="$date" +"%A, %B %e, %Y;  %H:%M"
# Organiser contact
printf "%80s\n\n\n" "$org"
# Title
printf "%*s\n\n" $(((72+$(echo "$title"|wc -c))/2)) "$title"
# Header
cat <<EOF
                     List of Participants  (v 1.0)


Here's what you have to do with this file:
(1) Print this file to paper.
(2) Compute this file's MD5 checksum and optionally also its SHA1 checksum.
   gpg --print-md md5  $output  (or use md5sum)
   gpg --print-md sha1 $output  (or use sha1sum)
(3) fill in the hash values on the printout.
(4) Bring the printout, a pen, and proof of identity to the keysigningparty (and be on time!).

MD5 Checksum:  __ __ __ __ __ __ __ __    __ __ __ __ __ __ __ __           [ ]



SHA1 Checksum: ____ ____ ____ ____ ____    ____ ____ ____ ____ ____         [ ]




EOF

k=0;
for i in $(cat $input); do 
    k=$(($k+1)); 
    printf "\n%03d  [ ] Fingerprint OK        [ ] ID OK\n" $k;
    gpg --fingerprint $i|grep -v "^sub";
done

At the party

Old notes...

Soient N personnes prêtes à signer
Ces personnes se numérotent de 0 à N-1 


  for (i=0;i<N;i++)
  { x signe (N-x+i)%N }

Puisque l'on fait ça N fois et que chacun ne doit signer que N-1 personnes, chacun sera passif lors d'UNE des itérations, simplement celle pour laquelle l'algo lui dit: x signe x
Bref tout le monde est occupé (N-1/N) % du temps :-)

Physiquement on peut se disposer en double file comme ceci: (ceux mis sur les bords ne signent pas) 


      |   i=0   |   i=1   |   i=2   |   i=3   |   i=4   |   i=5
  ----+---------+---------+---------+---------+---------+---------
      |   1 2   |   1 2   |   2 3   |   2 3   |   3 4   |
  N=5 | 0 | |   |   | | 3 | 1 | |   |   | | 4 | 2 | |   |
      |   4 3   |   0 4   |   0 4   |   1 0   |   1 0   |
  ----+---------+---------+---------+---------+---------+---------
      |   1 2   |  1 2 3  |   2 3   |  2 3 4  |   3 4   |  3 4 5
  N=6 | 0 | | 3 |  | | |  | 1 | | 4 |  | | |  | 2 | | 5 |  | | |
      |   5 4   |  0 5 4  |   0 5   |  1 0 5  |   1 0   |  2 1 0
  ----+---------+---------+---------+---------+---------+---------

Avantage de l'algo: lorsqu'on prépare les feuilles avec les fingerprints, on peut aussi préparer pour chacun l'ordre dans lequel il doit signer les autres: 

#!/bin/bash
# argument: nbre total de personnes
N=$1
for ((x=0;x<N;x++)); do
   echo -n "$x signera dans l'ordre: "
   for ((i=0;i<N;i++)); do
      echo -n "$((($N-$x+$i)%$N)) "
   done
   echo ""
done

UPDATE: intéressant, lors du FOSDEM 2008 c'est en double-rang que l'on a effectivement progressé, avec 200 personnes sur la liste il y avait intéret à optimiser en effet ;-)

After the signing party

  • I clean the list ksp-fosdem2008.txt to keep only those I met.
  • I extract the fingerprints
cat ksp-fosdem2008-ok.txt |grep fingerprint|sed 's/^.*= //;s/ //g'> ksp-fosdem2008-finger.txt
  • I configure caff, the first time it creates a template in ~/.caffrc which was nearly ok, I let only my usual public key, told to encrypt also for that key, activated the default email template, chose agpg as signing gpg program and finally chose a public keyserver:
$CONFIG{'local-user'} = [ qw{7A135F579AD7E3DB} ];
$CONFIG{'also-encrypt-to'} = [ qw{7A135F579AD7E3DB} ];
$CONFIG{'gpg-sign'} = '/usr/bin/agpg';
$CONFIG{'keyserver'} = 'wwwkeys.pgp.net';
  • I could not get caff working until I finally copied ~/.gnupg/pubring.gpg and ~/.gnupg/trustdb.gpg to ~/.caff/gnupghome/ then everything worked including import of new keys from the keyserver.
  • Signing only:
caff --no-download --no-export-old --no-mail $(cat ksp-fosdem2008-finger.txt)
yes / save (check twice the uids as you could have forgotten to remove it in ksp-fosdem2008-ok.txt)
  • Sending emails:
caff --no-download --no-sign --no-export-old $(cat ksp-fosdem2008-finger.txt)
  • I got some undeliverable emails, some obviously being jabber ids, so I recovered the email content from ~/.caff/keys/2008-02-24 and sent it over jabber.
  • Short way for a professional signing-party using an internal keyserver:
#!/bin/bash

for i in $(cat <<EOF
98851B2B8B5B43104A25ECA1A6F4CF46E9A11073
56CFE246BB33A42F1142646EE9E8031D67147274
...
EOF) ; do
    gpg --recv-key $i;
    agpg -u nxp --sign-key $i;
    gpg --send-key $i;
done
  • In case you mistype your passphrase with quintuple-agent (agpg), you've to delete the stored passphrase before trying again:
q-client list
q-client delete 54C12701
  • You'll receive also the signatures of (some of) your peers by mail. If you use Enigmail, you can simply right-click on the attachment and choose "Import OpenPGP key", that's it!
    Don't forget to retrieve also your key from the keyservers as some people push directly their signature instead of sending you a mail.
  • Check who has signed your key:
gpglist 9AD7E3DB

Later after the signing-party

A post of Philip on his blog highlighted the fact that a certain amount of people don't do their homework.

So I wrote a small script to see my own status: 

#!/bin/bash

# Copyright: Philippe Teuwen <phil a teuwen o org>
# License:   GPLv2 or later
# This requires the gpglist and caff tools provided with signing-party package

##########################################################

# DATE is a globbing pattern for the folders in ~/.caff/keys
# Leave * to consider all mails you've sent through caff
DATE="2008*"

KEYID=

##########################################################

# If no keyid given, let's take the first one we find:
if [ "$KEYID" == "" ]; then
    KEYID=$(gpg --list-secret-keys|\
		awk '/^sec/{sub(/.*\//,"",$2);print $2;exit}')
fi
WHODIDSIGN=/tmp/who-did-sign-$$
WHODIDUPLOAD=/tmp/who-did-upload-$$

# Generating a temp list of those who signed my key
gpglist $KEYID |\
    sed '1,/^1/d;s/^[x ]\+//;s/ .*$//' \
    > $WHODIDSIGN

# Getting a list of those we've only unidirectional signatures on the keyservers
wget -q -O - "http://pgp.cs.uu.nl/mk_path.cgi?STAT=$KEYID&STATS=statistics"|\
    awk '
	/<\/UL>/ {b=0}
	/<LI>/ && b==1 {
	    match($0,/.*SMALL>(.*)<\/SMALL.*/,a);
	    print a[1]
	}
	/by this key/ {b=1}' \
    > $WHODIDUPLOAD

# Print some stats of nr I signed (via caff):
echo -n "==== Nr of people I signed: "
find ~/.caff/keys/$DATE/*.mail.1.* -type f|wc -l

echo "==== Those who didn't sign me in turn: (in red the leechers)"
# Generating list of those I signed (via caff) and substracting the first list
# Displaying results, in red those leechers who uploaded your sig on their key
# but were too lazy to do their homework to sign your key
find ~/.caff/keys/$DATE/*.mail.1.* -type f -exec basename {} \;|\
    grep -v -f $WHODIDSIGN|\
    sed 's/\.mail\.1\./ /'|\
    sort -k 2 |\
    grep --color=auto -C1000 -f $WHODIDUPLOAD

rm -f $WHODIDSIGN $WHODIDUPLOAD

Note that the script does not take into account the fact that some people came with several keys and already signed my key with one of their keys.

Here is a (cleaned) output, replacing the red flags by !! after Fosdem 2008: 

==== Nr of people I signed: 85
==== Those who didn't sign me in turn: (in !! the leechers)
   99CBF9FDF4516C2D Adam Boardman
!! 28B5F4DD948F646C Adrien Kunysz (Krunch)
!! B7511409FC15DBEC Alexios Zavras (zvr)
!! 152865FB627CCF95 Bas Wijnen
!! 8F70629AC718D347 Bradley John Smith
!! 6FD13DDCD7CDE9E6 Bram Van Dam
   37E950505B625015 David Vuorio
!! 103CAA693891CD0B Guido Serra (GNU_Linux sysadmin, developer)
!! 9C19DB3C039ACDF0 Jose Maria Casanova Crespo (Chema)
   269CC0A1EEE120A2 Katharina Peter
   8D3867D89DDB992B Luca Capello
   C87C13316AA2C883 Machteld de Kok
!! 3C4DE8C0E4B48C48 Nanaea Geyer (Privat)
!! 85E7F6EC89789A18 Sebastian Noack
   3048C78B7984A4FD Toni Timonen
   9D9D7CE70BF3708E Xavier Lagorce
Retrieved from "https://wiki.yobi.be/index.php?title=GnuPG_signing_parties&oldid=9906"