Difference between revisions of "GnuPG"

From YobiWiki
Jump to navigation Jump to search
Line 618: Line 618:
 
* Check who has signed your key:
  
* Check who has signed your key:
 
gpglist 9AD7E3DB
  
gpglist 9AD7E3DB
  +
  +
===Later after the signing-party===
  +
A [http://www.paeps.cx/weblog/fosdem/fosdem_keysigning_signatures.html post of Philip on his blog] highlighted the fact that a certain amount of people don't do their homework.
  +
  +
So I wrote a small script to see my own status:
  +
<pre>
  +
#!/bin/bash
  +
  +
# Copyright: Philippe Teuwen <phil a teuwen o org>
  +
# License: GPLv2 or later
  +
# This requires the gpglist and caff tools provided with signing-party package
  +
  +
##########################################################
  +
  +
# DATE is a globbing pattern for the folders in ~/.caff/keys
  +
# Leave * to consider all mails you've sent through caff
  +
DATE="2008*"
  +
  +
KEYID=
  +
  +
##########################################################
  +
  +
# If no keyid given, let's take the first one we find:
  +
if [ "$KEYID" == "" ]; then
  +
KEYID=$(gpg --list-secret-keys|\
  +
awk '/^sec/{sub(/.*\//,"",$2);print $2;exit}')
  +
fi
  +
WHODIDSIGN=/tmp/who-did-sign-$$
  +
WHODIDUPLOAD=/tmp/who-did-upload-$$
  +
  +
# Generating a temp list of those who signed my key
  +
gpglist $KEYID |\
  +
sed '1,/^1/d;s/^[x ]\+//;s/ .*$//' \
  +
> $WHODIDSIGN
  +
  +
# Getting a list of those we've only unidirectional signatures on the keyservers
  +
wget -q -O - "http://pgp.cs.uu.nl/mk_path.cgi?STAT=$KEYID&STATS=statistics"|\
  +
awk '
  +
/<\/UL>/ {b=0}
  +
/<LI>/ && b==1 {
  +
match($0,/.*SMALL>(.*)<\/SMALL.*/,a);
  +
print a[1]
  +
}
  +
/by this key/ {b=1}' \
  +
> $WHODIDUPLOAD
  +
  +
# Print some stats of nr I signed (via caff):
  +
echo -n "==== Nr of people I signed: "
  +
find ~/.caff/keys/$DATE/*.mail.1.* -type f|wc -l
  +
  +
echo "==== Those who didn't sign me in turn: (in red the leechers)"
  +
# Generating list of those I signed (via caff) and substracting the first list
  +
# Displaying results, in red those leechers who uploaded your sig on their key
  +
# but were too lazy to do their homework to sign your key
  +
find ~/.caff/keys/$DATE/*.mail.1.* -type f -exec basename {} \;|\
  +
grep -v -f $WHODIDSIGN|\
  +
sed 's/\.mail\.1\./ /'|\
  +
sort -k 2 |\
  +
grep --color=auto -C1000 -f $WHODIDUPLOAD
  +
  +
rm -f $WHODIDSIGN $WHODIDUPLOAD
  +
</pre>
  +
  +
Note that the script does not take into account the fact that some people came with several keys and already signed my key with one of their keys.
  +
  +
Here is a (cleaned) output, replacing the red flags by !!:
  +
<pre>
  +
==== Nr of people I signed: 85
  +
==== Those who didn't sign me in turn: (in !! the leechers)
  +
99CBF9FDF4516C2D Adam Boardman <gpg2@adamboardman.co.uk>
  +
!! 28B5F4DD948F646C Adrien Kunysz (Krunch) <adrien@kunysz.be>
  +
!! B7511409FC15DBEC Alexios Zavras (zvr) <zvr@zvr.gr>
  +
!! 152865FB627CCF95 Bas Wijnen <wijnen@debian.org>
  +
!! 8F70629AC718D347 Bradley John Smith <brad@brad-smith.co.uk>
  +
!! 6FD13DDCD7CDE9E6 Bram Van Dam <bram@lick-me.org>
  +
37E950505B625015 David Vuorio <vuorio@kth.se>
  +
!! BB3D54B647EA84B4 Grégoire Vincke <gregoire.vincke@fundp.ac.be>
  +
!! 103CAA693891CD0B Guido Serra (GNU_Linux sysadmin, developer) <zeph@guidoserra.it>
  +
!! 8B4AC481AC1E715E Jeroen Dekkers <jeroen@dekkers.cx>
  +
!! 9C19DB3C039ACDF0 Jose Maria Casanova Crespo (Chema) <jmcasanova@igalia.com>
  +
269CC0A1EEE120A2 Katharina Peter <katharina.peter@rwth-aachen.de>
  +
8D3867D89DDB992B Luca Capello <luca@pca.it>
  +
C87C13316AA2C883 Machteld de Kok <machteld_de_kok@hotmail.com>
  +
962CDAF73BC4081F Michael Cox (Belgium) <mr.michaelcox@gmail.com>
  +
!! 3C4DE8C0E4B48C48 Nanaea Geyer (Privat) <nanaea.fv.tu@nds.tu-darmstadt.de>
  +
!! 85E7F6EC89789A18 Sebastian Noack <s.noack@placement24.com>
  +
8F076F6B9AE540A0 Simon Liu (Liu Cheng) <simon@smurfoncrack.com>
  +
!! 4ADB1F886B885443 Thomas Clavier (TcWeb) <tom@tcweb.org>
  +
3048C78B7984A4FD Toni Timonen <toni.timonen@iki.fi>
  +
9D9D7CE70BF3708E Xavier Lagorce <xavier.lagorce@crans.org>
  +
</pre>
  +
So 9 of which no activity so far and 12 who uploaded my signature on the keyservers but did not do their job in turn :-(
  +
<br>Not that bad compared to Philip...

Revision as of 00:39, 23 March 2008

French part was converted with HTML::WikiConverter::MediaWiki from my old phpwiki site

Intro

Un très bon point de départ: http://www.gnupg.org/gph/fr/manual.html

Une introduction a GnuPG(vulgaristation): http://www.vilya.org/gpg/

Mes clés

On peut les trouver un peu partout. 

   gpg --keyserver wwwkeys.pgp.net --recv-key 0x7A135F579AD7E3DB

Serveurs publics

Key Signing Coordination

http://www.biglumber.com/

Distance entre clés

Par exemple
http://keyserver.kjsl.com/~jharris/gpgwww.cgi?from=135EA668&to=9AD7E3DB
http://keyserver.kjsl.com/~jharris/gpgwww.cgi?from=449FA3AB&to=9AD7E3DB
Remplacer les IDs des clés pour essayer d'autres chemins.

Update: les URLs précédentes ne fonctionnent apparemment plus, vous pouvez essayer avec celles-ci:
http://pgp.cs.uu.nl/mk_path.cgi?FROM=135EA668&TO=9AD7E3DB&PATHS=trust+paths
http://pgp.cs.uu.nl/mk_path.cgi?FROM=449FA3AB=9AD7E3DB&PATHS=trust+paths

http://www.cs.uu.nl/people/henkp/henkp/pgp/pathfinder/mk_path.cgi?STAT=9AD7E3DB&STATS=statistics

Strong Set

Une analyse globale est disponible ici: http://pgp.cs.uu.nl/plot/
J'y suis rentré en août 2002 avec une distance moyenne de 6.9916 (merci adulau ;-)
Des analyses mensuelles sont disponibles ici: http://keyserver.kjsl.com/~jharris/ka

Date Mean dist World class From Set to ID From ID to Set Max hops Strong set Average mean

08-2002

6.9916 >1000 - - 15 14159 6.5105

11-08-2002

5.7041 >1000 - - 14 14353 6.5222

25-08-2002

5.6948 >1000 - - 14 14586 6.5327

08-09-2002

5.6979 >1000 - - 14 14797 6.5561

22-09-2002

5.6648 >1000 - - 14 14973 6.5084

06-10-2002

5.6414 >1000 - - 14 15169 6.5101

20-10-2002

5.6296 >1000 9 12 14 15370 6.5037

03-11-2002

5.5183 >1000 19 27 13 15575 6.5045

17-11-2002

5.4787 >1000 24 27 13 15787 6.5017

01-12-2002

5.4420 >1000 24 27 13 15949 6.4797

15-12-2002

5.4373 >1000 24 27 13 16174 6.4806

29-12-2002

5.3922 >1000 24 27 13 16305 6.4931

12-01-2003

5.3865 >1000 24 27 13 16474 6.4804

26-01-2003

5.2183 >1000 24 27 13 16673 6.4706

09-02-2003

5.2173 >1000 24 27 13 16951 6.4849

23-02-2003

4.7102 496 43 63 13 17338 6.4773

09-03-2003

4.7024 507 45 63 13 17620 6.4711

23-03-2003

4.6933 500 46 63 13 17861 6.4675

06-04-2003

4.6794 481 47 63 13 18197 6.6484

20-04-2003

4.6373 367 51 67 13 19075 6.6624

04-05-2003

4.6281 358 51 67 13 19372 6.6584

18-05-2003

4.6027 330 51 67 13 19641 6.6410

01-06-2003

4.6002 331 51 67 13 19833 6.6261

15-06-2003

4.5854 335 52 68 13 20095 6.6038

29-06-2003

4.5700 330 52 68 13 20305 6.5954

13-07-2003

4.5531 327 52 68 13 20602 6.5762

27-07-2003

4.5189 419 52 68 13 20814 6.5251

10-08-2003

4.4803 440 52 68 13 21025 6.4861

24-08-2003

4.4676 461 58 75 13 21333 6.4784

07-09-2003

4.4565 462 59 76 13 21487 6.4721

05-10-2003

4.4456 482 59 76 13 21843 6.4762

17-02-2008

4.4435 1761 16 91 14 40282 5.98?

--2008

4. - 0 0 0 - 6. 
  #!/bin/bash
  # gpg-setstats retrieves stats about the strongset & your key
  REF="http://skylane.kjsl.com/~jharris/ka"
  MYKEY=${1:-"9AD7E3DB"}

  for URL in $(lynx -dump $REF|grep "$REF/200"|cut -c 7-53); do
    select q in "Stats for the ${URL#$REF}" "Skip" "Quit";do
    if [ "$q" == "Stats for the ${URL#$REF}" ]; then
      echo =======================================
      echo Retrieve infos for ${URL#$REF}:
      wget -O - -q ${URL}other.txt
      wget -O - -q ${URL}status.txt|grep "strongly connected"
      wget -O - -q $URL${MYKEY:0:2}/$MYKEY|grep "^KeyID\|^Total\|^Mean\|^Farthest"
      echo -n "World Class:"
      lynx -dump ${URL}top1000table.html|grep $MYKEY|grep -v kjsl
      echo =======================================
      break; fi
    if [ "$q" == "Skip"  ]; then
      break; fi
    if [ "$q" == "Quit" ]; then
      exit; fi
    echo test $URL
    done
  done

Tips

Pour fetcher ttes les UIDs qui ont signé une clé

  for key in $(gpg --list-sigs $1|grep ^sig|cut -c 13-20|sort|uniq);
  do
   gpg --recv-key $key
  done

quintuple-agent

  eval `q-agent &`
  q-client put 9AD7E3DB -t 3600
  or directly use agpg instead of gpg

Support de OpenPGP dans KMail:


 wget ftp://ftp.gnupg.org/gcrypt/alpha/aegypten/debian/libksba0_0.4.3-1_i386.deb
 dpkg -i libksba0_0.4.3-1_i386.deb
 wget ftp://ftp.gnupg.org/gcrypt/alpha/aegypten/debian/pinentry-gtk_0.6.3-1_i386.deb
 dpkg -i pinentry-gtk_0.6.3-1_i386.deb
 wget ftp://ftp.gnupg.org/gcrypt/alpha/aegypten/debian/gpgsm_0.3.9-1_i386.deb
 dpkg -i gpgsm_0.3.9-1_i386.deb
 gpg --rebuild-keydb-caches

Editer ~/.gnupg/gpg.conf -> use-agent
Dans KMail, Settings->Configure KMail->Security->Crypto Plugins et ajouter gpgme-openpgp.so plugin.
Laisser "update URL" vide et mettre un nom comme par ex. "OpenPGP", "location": /usr/lib/cryptplug/gpgme-opengpg.so

/usr/local/bin/gpg-kmail: 


 #!/bin/bash
 launch_me(){
    eval "$(gpg-agent --pinentry-program /usr/bin/pinentry-gtk --no-grab --default-cache-ttl 1800 )"
    kmail $* --nofork
    echo $GPG_AGENT_INFO|cut -d: -f2|xargs kill
 }
 launch_me $* &
 exit 0

Paper backup of the secret keys

apt-get install paperkey
gpg --export-secret-key key_id | paperkey

Notes on signing-parties

Old notes

Pas mal d'infos sur http://skylane.kjsl.com/~jharris/keysigning.html
Ainsi que des exemples d'annonce par Adulau sur http://www.ael.be/action/gnupg/ et http://www.ael.be/action/gnupg/fosdem/
Mais un problème courant est la coordination physique des gens pour que chacun rencontre chacun.

Before the party

There are some useful tools in Debian: 

apt-get install signing-party

Here is an example based on my participation to the keysigning-party of FOSDEM 2008

  • Importing keys: the organizer provided a file with all the keys exported
tar xzvf keys.tgz
for i in keys/*; do gpg --import $i;done
  • Preparing the given list of keys: the organizer provided a list such as in the examples provided here: /usr/share/doc/signing-party/gpgsigs/examples/. To prepare that file, compute its checksums and add the pictures when possible:
gpgsigs --latex 9ad7e3db ksp-fosdem2008.txt ksp-fosdem2008
latex ksp-fosdem2008
dvips ksp-fosdem2008.dvi
ps2pdf ksp-fosdem2008.ps > ksp-fosdem2008.pdf
  • Preparing a stock of our own fingerprints, in case of...
gpg-key2ps 9ad7e3db |ps2pdf - 9ad7e3db.pdf
  • But after all how was produced the list of fingerprints from the organizer? I created a script to generate such list: (proposed at Debian)
#!/bin/bash

# License: GPLv3
# Copyright Philippe Teuwen <phil a teuwen o org> 2008
if [[ $# -ne 5 ]]; then
    cat <<EOF
Usage: $0 input output datestring organizer title
Or:    $0 -     output datestring organizer title
       to read from STDIN
Example:
       echo 9AD7E3DB 54C12701 |\\
       $0 - ksp-file.txt "20080222 1100" "Philippe Teuwen <phil a teuwen o org>" "my party 08"
EOF
    exit 0
fi

input="$1"
[ "$input" == "-" ] && input="";
output="$2"
date="$3"
org="$4"
title=$(echo "$5"|tr a-z A-Z|sed 's/\(.\)/\1 /g')

exec > "$output"

# Date of event
LANG=C date --date="$date" +"%A, %B %e, %Y;  %H:%M"
# Organiser contact
printf "%80s\n\n\n" "$org"
# Title
printf "%*s\n\n" $(((72+$(echo "$title"|wc -c))/2)) "$title"
# Header
cat <<EOF
                     List of Participants  (v 1.0)


Here's what you have to do with this file:
(1) Print this file to paper.
(2) Compute this file's MD5 checksum and optionally also its SHA1 checksum.
   gpg --print-md md5  $output  (or use md5sum)
   gpg --print-md sha1 $output  (or use sha1sum)
(3) fill in the hash values on the printout.
(4) Bring the printout, a pen, and proof of identity to the keysigningparty (and be on time!).

MD5 Checksum:  __ __ __ __ __ __ __ __    __ __ __ __ __ __ __ __           [ ]



SHA1 Checksum: ____ ____ ____ ____ ____    ____ ____ ____ ____ ____         [ ]




EOF

k=0;
for i in $(cat $input); do 
    k=$(($k+1)); 
    printf "\n%03d  [ ] Fingerprint OK        [ ] ID OK\n" $k;
    gpg --fingerprint $i|grep -v "^sub";
done

At the party

Old notes...

Soient N personnes prêtes à signer
Ces personnes se numérotent de 0 à N-1 


  for (i=0;i<N;i++)
  { x signe (N-x+i)%N }

Puisque l'on fait ça N fois et que chacun ne doit signer que N-1 personnes, chacun sera passif lors d'UNE des itérations, simplement celle pour laquelle l'algo lui dit: x signe x
Bref tout le monde est occupé (N-1/N) % du temps :-)

Physiquement on peut se disposer en double file comme ceci: (ceux mis sur les bords ne signent pas) 


      |   i=0   |   i=1   |   i=2   |   i=3   |   i=4   |   i=5
  ----+---------+---------+---------+---------+---------+---------
      |   1 2   |   1 2   |   2 3   |   2 3   |   3 4   |
  N=5 | 0 | |   |   | | 3 | 1 | |   |   | | 4 | 2 | |   |
      |   4 3   |   0 4   |   0 4   |   1 0   |   1 0   |
  ----+---------+---------+---------+---------+---------+---------
      |   1 2   |  1 2 3  |   2 3   |  2 3 4  |   3 4   |  3 4 5
  N=6 | 0 | | 3 |  | | |  | 1 | | 4 |  | | |  | 2 | | 5 |  | | |
      |   5 4   |  0 5 4  |   0 5   |  1 0 5  |   1 0   |  2 1 0
  ----+---------+---------+---------+---------+---------+---------

Avantage de l'algo: lorsqu'on prépare les feuilles avec les fingerprints, on peut aussi préparer pour chacun l'ordre dans lequel il doit signer les autres: 


  #!/bin/bash
  # argument: nbre total de personnes
  N=$1
  for ((x=0;x<N;x++)); do
     echo -n "$x signera dans l'ordre: "
     for ((i=0;i<N;i++)); do
        echo -n "$((($N-$x+$i)%$N)) "
     done
     echo ""
  done

UPDATE: intéressant, lors du FOSDEM 2008 c'est en double-rang que l'on a effectivement progressé, avec 200 personnes sur la liste il y avait intéret à optimiser en effet ;-)

After the signing party

  • I clean the list ksp-fosdem2008.txt to keep only those I met.
  • I extract the fingerprints
cat ksp-fosdem2008-ok.txt |grep fingerprint|sed 's/^.*= //;s/ //g'> ksp-fosdem2008-finger.txt
  • I configure caff, the first time it creates a template in ~/.caffrc which was nearly ok, I let only my usual public key, told to encrypt also for that key, activated the default email template, chose agpg as signing gpg program and finally chose a public keyserver:
$CONFIG{'local-user'} = [ qw{7A135F579AD7E3DB} ];
$CONFIG{'also-encrypt-to'} = [ qw{7A135F579AD7E3DB} ];
$CONFIG{'gpg-sign'} = '/usr/bin/agpg';
$CONFIG{'keyserver'} = 'wwwkeys.pgp.net';
  • I could not get caff working until I finally copied ~/.gnupg/pubring.gpg and ~/.gnupg/trustdb.gpg to ~/.caff/gnupghome/ then everything worked including import of new keys from the keyserver.
  • Signing only:
caff --no-download --no-export-old --no-mail $(cat ksp-fosdem2008-finger.txt)
yes / save (check twice the uids as you could have forgotten to remove it in ksp-fosdem2008-ok.txt)
  • Sending emails:
caff --no-download --no-sign --no-export-old $(cat ksp-fosdem2008-finger.txt)
  • I got some undeliverable emails, some obviously being jabber ids, so I recovered the email content from ~/.caff/keys/2008-02-24 and sent it over jabber.
  • Short way for a professional signing-party using an internal keyserver:
#!/bin/bash

for i in $(cat <<EOF
98851B2B8B5B43104A25ECA1A6F4CF46E9A11073
56CFE246BB33A42F1142646EE9E8031D67147274
...
EOF) ; do
    gpg --recv-key $i;
    agpg -u nxp --sign-key $i;
    gpg --send-key $i;
done
  • In case you mistype your passphrase with quintuple-agent (agpg), you've to delete the stored passphrase before trying again:
q-client list
q-client delete 54C12701
  • Check who has signed your key:
gpglist 9AD7E3DB

Later after the signing-party

A post of Philip on his blog highlighted the fact that a certain amount of people don't do their homework.

So I wrote a small script to see my own status: 

#!/bin/bash

# Copyright: Philippe Teuwen <phil a teuwen o org>
# License:   GPLv2 or later
# This requires the gpglist and caff tools provided with signing-party package

##########################################################

# DATE is a globbing pattern for the folders in ~/.caff/keys
# Leave * to consider all mails you've sent through caff
DATE="2008*"

KEYID=

##########################################################

# If no keyid given, let's take the first one we find:
if [ "$KEYID" == "" ]; then
    KEYID=$(gpg --list-secret-keys|\
		awk '/^sec/{sub(/.*\//,"",$2);print $2;exit}')
fi
WHODIDSIGN=/tmp/who-did-sign-$$
WHODIDUPLOAD=/tmp/who-did-upload-$$

# Generating a temp list of those who signed my key
gpglist $KEYID |\
    sed '1,/^1/d;s/^[x ]\+//;s/ .*$//' \
    > $WHODIDSIGN

# Getting a list of those we've only unidirectional signatures on the keyservers
wget -q -O - "http://pgp.cs.uu.nl/mk_path.cgi?STAT=$KEYID&STATS=statistics"|\
    awk '
	/<\/UL>/ {b=0}
	/<LI>/ && b==1 {
	    match($0,/.*SMALL>(.*)<\/SMALL.*/,a);
	    print a[1]
	}
	/by this key/ {b=1}' \
    > $WHODIDUPLOAD

# Print some stats of nr I signed (via caff):
echo -n "==== Nr of people I signed: "
find ~/.caff/keys/$DATE/*.mail.1.* -type f|wc -l

echo "==== Those who didn't sign me in turn: (in red the leechers)"
# Generating list of those I signed (via caff) and substracting the first list
# Displaying results, in red those leechers who uploaded your sig on their key
# but were too lazy to do their homework to sign your key
find ~/.caff/keys/$DATE/*.mail.1.* -type f -exec basename {} \;|\
    grep -v -f $WHODIDSIGN|\
    sed 's/\.mail\.1\./ /'|\
    sort -k 2 |\
    grep --color=auto -C1000 -f $WHODIDUPLOAD

rm -f $WHODIDSIGN $WHODIDUPLOAD

Note that the script does not take into account the fact that some people came with several keys and already signed my key with one of their keys.

Here is a (cleaned) output, replacing the red flags by !!: 

==== Nr of people I signed: 85
==== Those who didn't sign me in turn: (in !! the leechers)
   99CBF9FDF4516C2D Adam Boardman <gpg2@adamboardman.co.uk>
!! 28B5F4DD948F646C Adrien Kunysz (Krunch) <adrien@kunysz.be>
!! B7511409FC15DBEC Alexios Zavras (zvr) <zvr@zvr.gr>
!! 152865FB627CCF95 Bas Wijnen <wijnen@debian.org>
!! 8F70629AC718D347 Bradley John Smith <brad@brad-smith.co.uk>
!! 6FD13DDCD7CDE9E6 Bram Van Dam <bram@lick-me.org>
   37E950505B625015 David Vuorio <vuorio@kth.se>
!! BB3D54B647EA84B4 Grégoire Vincke <gregoire.vincke@fundp.ac.be>
!! 103CAA693891CD0B Guido Serra (GNU_Linux sysadmin, developer) <zeph@guidoserra.it>
!! 8B4AC481AC1E715E Jeroen Dekkers <jeroen@dekkers.cx>
!! 9C19DB3C039ACDF0 Jose Maria Casanova Crespo (Chema) <jmcasanova@igalia.com>
   269CC0A1EEE120A2 Katharina Peter <katharina.peter@rwth-aachen.de>
   8D3867D89DDB992B Luca Capello <luca@pca.it>
   C87C13316AA2C883 Machteld de Kok <machteld_de_kok@hotmail.com>
   962CDAF73BC4081F Michael Cox (Belgium) <mr.michaelcox@gmail.com>
!! 3C4DE8C0E4B48C48 Nanaea Geyer (Privat) <nanaea.fv.tu@nds.tu-darmstadt.de>
!! 85E7F6EC89789A18 Sebastian Noack <s.noack@placement24.com>
   8F076F6B9AE540A0 Simon Liu (Liu Cheng) <simon@smurfoncrack.com>
!! 4ADB1F886B885443 Thomas Clavier (TcWeb) <tom@tcweb.org>
   3048C78B7984A4FD Toni Timonen <toni.timonen@iki.fi>
   9D9D7CE70BF3708E Xavier Lagorce <xavier.lagorce@crans.org>

So 9 of which no activity so far and 12 who uploaded my signature on the keyservers but did not do their job in turn :-(
Not that bad compared to Philip...

Retrieved from "https://wiki.yobi.be/index.php?title=GnuPG&oldid=3970"