Difference between revisions of "GnuPG"

From YobiWiki
Jump to navigation Jump to search
Line 456: Line 456:
 
gpg --export-secret-key key_id | paperkey
  
gpg --export-secret-key key_id | paperkey
   
−
==Notes on signing-parties==
 +
==[[GnuPG signing parties]]==
−
===Old notes===
  
   
−
Pas mal d'infos sur http://skylane.kjsl.com/~jharris/keysigning.html<br />Ainsi que des exemples d'annonce par Adulau sur http://www.ael.be/action/gnupg/ et http://www.ael.be/action/gnupg/fosdem/<br />Mais un problème courant est la coordination physique des gens pour que chacun rencontre chacun.
  
−  
−
===Before the party===
  
−
There are some useful tools in Debian:
  
−
apt-get install signing-party
  
−
Here is an example based on my participation to the keysigning-party of FOSDEM 2008
  
−  
−
* Importing keys: the organizer provided a file with all the keys exported
  
−
tar xzvf keys.tgz
  
−
for i in keys/*; do gpg --import $i;done
  
−  
−
* Preparing the given list of keys: the organizer provided a list such as in the examples provided here: /usr/share/doc/signing-party/gpgsigs/examples/. To prepare that file, compute its checksums and add the pictures when possible:
  
−
gpgsigs --latex 9ad7e3db ksp-fosdem2008.txt ksp-fosdem2008
  
−
latex ksp-fosdem2008
  
−
dvips ksp-fosdem2008.dvi
  
−
ps2pdf ksp-fosdem2008.ps > ksp-fosdem2008.pdf
  
−  
−
* Preparing a stock of our own fingerprints, in case of...
  
−
gpg-key2ps 9ad7e3db |ps2pdf - 9ad7e3db.pdf
  
−  
−
* But after all how was produced the list of fingerprints from the organizer? I created a script to generate such list: ([http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=467338 proposed at Debian])
  
−
<source lang=bash>
  
−
#!/bin/bash
  
−  
−
# License: GPLv3
  
−
# Copyright Philippe Teuwen <phil a teuwen o org> 2008
  
−
if [[ $# -ne 5 ]]; then
  
−
cat <<EOF
  
−
Usage: $0 input output datestring organizer title
  
−
Or: $0 - output datestring organizer title
  
−
to read from STDIN
  
−
Example:
  
−
echo 9AD7E3DB 54C12701 |\\
  
−
$0 - ksp-file.txt "20080222 1100" "Philippe Teuwen <phil a teuwen o org>" "my party 08"
  
−
EOF
  
−
exit 0
  
−
fi
  
−  
−
input="$1"
  
−
[ "$input" == "-" ] && input="";
  
−
output="$2"
  
−
date="$3"
  
−
org="$4"
  
−
title=$(echo "$5"|tr a-z A-Z|sed 's/\(.\)/\1 /g')
  
−  
−
exec > "$output"
  
−  
−
# Date of event
  
−
LANG=C date --date="$date" +"%A, %B %e, %Y; %H:%M"
  
−
# Organiser contact
  
−
printf "%80s\n\n\n" "$org"
  
−
# Title
  
−
printf "%*s\n\n" $(((72+$(echo "$title"|wc -c))/2)) "$title"
  
−
# Header
  
−
cat <<EOF
  
−
List of Participants (v 1.0)
  
−  
−  
−
Here's what you have to do with this file:
  
−
(1) Print this file to paper.
  
−
(2) Compute this file's MD5 checksum and optionally also its SHA1 checksum.
  
−
gpg --print-md md5 $output (or use md5sum)
  
−
gpg --print-md sha1 $output (or use sha1sum)
  
−
(3) fill in the hash values on the printout.
  
−
(4) Bring the printout, a pen, and proof of identity to the keysigningparty (and be on time!).
  
−  
−
MD5 Checksum: __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ __ [ ]
  
−  
−  
−  
−
SHA1 Checksum: ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ [ ]
  
−  
−  
−  
−  
−
EOF
  
−  
−
k=0;
  
−
for i in $(cat $input); do
 
−
k=$(($k+1));
 
−
printf "\n%03d [ ] Fingerprint OK [ ] ID OK\n" $k;
  
−
gpg --fingerprint $i|grep -v "^sub";
  
−
done
  
−
</source>
  
−  
−
===At the party===
  
−
Old notes...
  
−  
−
Soient N personnes prêtes à signer <br />Ces personnes se numérotent de 0 à N-1
  
−  
−
 
−
for (i=0;i<N;i++)
  
−
{ x signe (N-x+i)%N }
  
−  
−
Puisque l'on fait ça N fois et que chacun ne doit signer que N-1 personnes, chacun sera passif lors d'UNE des itérations, simplement celle pour laquelle l'algo lui dit: x signe x <br />Bref tout le monde est occupé (N-1/N) % du temps :-)
  
−  
−
Physiquement on peut se disposer en double file comme ceci: (ceux mis sur les bords ne signent pas)
  
−  
−
 
−
| i=0 | i=1 | i=2 | i=3 | i=4 | i=5
  
−
----+---------+---------+---------+---------+---------+---------
  
−
| 1 2 | 1 2 | 2 3 | 2 3 | 3 4 |
  
−
N=5 | 0 | | | | | 3 | 1 | | | | | 4 | 2 | | |
  
−
| 4 3 | 0 4 | 0 4 | 1 0 | 1 0 |
  
−
----+---------+---------+---------+---------+---------+---------
  
−
| 1 2 | 1 2 3 | 2 3 | 2 3 4 | 3 4 | 3 4 5
  
−
N=6 | 0 | | 3 | | | | | 1 | | 4 | | | | | 2 | | 5 | | | |
  
−
| 5 4 | 0 5 4 | 0 5 | 1 0 5 | 1 0 | 2 1 0
  
−
----+---------+---------+---------+---------+---------+---------
  
−  
−
Avantage de l'algo: lorsqu'on prépare les feuilles avec les fingerprints, on peut aussi préparer pour chacun l'ordre dans lequel il doit signer les autres:
  
−  
−
<source lang=bash>
  
−
#!/bin/bash
  
−
# argument: nbre total de personnes
  
−
N=$1
  
−
for ((x=0;x<N;x++)); do
  
−
echo -n "$x signera dans l'ordre: "
  
−
for ((i=0;i<N;i++)); do
  
−
echo -n "$((($N-$x+$i)%$N)) "
  
−
done
  
−
echo ""
  
−
done
  
−
</source>
  
−
UPDATE: intéressant, lors du FOSDEM 2008 c'est en double-rang que l'on a effectivement progressé, avec 200 personnes sur la liste il y avait intéret à optimiser en effet ;-)
  
−  
−
===After the signing party===
  
−
* I clean the list ksp-fosdem2008.txt to keep only those I met.
  
−
* I extract the fingerprints
  
−
cat ksp-fosdem2008-ok.txt |grep fingerprint|sed 's/^.*= //;s/ //g'> ksp-fosdem2008-finger.txt
  
−
* I configure caff, the first time it creates a template in ~/.caffrc which was nearly ok, I let only my usual public key, told to encrypt also for that key, activated the default email template, chose agpg as signing gpg program and finally chose a public keyserver:
  
−
$CONFIG{'local-user'} = [ qw{7A135F579AD7E3DB} ];
  
−
$CONFIG{'also-encrypt-to'} = [ qw{7A135F579AD7E3DB} ];
  
−
$CONFIG{'gpg-sign'} = '/usr/bin/agpg';
  
−
$CONFIG{'keyserver'} = 'wwwkeys.pgp.net';
  
−
* I could not get caff working until I finally copied ~/.gnupg/pubring.gpg and ~/.gnupg/trustdb.gpg to ~/.caff/gnupghome/ then everything worked including import of new keys from the keyserver.
  
−
* Signing only:
  
−
caff --no-download --no-export-old --no-mail $(cat ksp-fosdem2008-finger.txt)
  
−
yes / save (check twice the uids as you could have forgotten to remove it in ksp-fosdem2008-ok.txt)
  
−
* Sending emails:
  
−
caff --no-download --no-sign --no-export-old $(cat ksp-fosdem2008-finger.txt)
  
−
* I got some undeliverable emails, some obviously being jabber ids, so I recovered the email content from ~/.caff/keys/2008-02-24 and sent it over jabber.
  
−  
−
* Short way for a professional signing-party using an internal keyserver:
  
−
<source lang=bash>
  
−
#!/bin/bash
  
−  
−
for i in $(cat <<EOF
  
−
98851B2B8B5B43104A25ECA1A6F4CF46E9A11073
  
−
56CFE246BB33A42F1142646EE9E8031D67147274
  
−
...
  
−
EOF) ; do
  
−
gpg --recv-key $i;
  
−
agpg -u nxp --sign-key $i;
  
−
gpg --send-key $i;
  
−
done
  
−
</source>
  
−  
−
* In case you mistype your passphrase with quintuple-agent (agpg), you've to delete the stored passphrase before trying again:
  
−
q-client list
  
−
q-client delete 54C12701
  
−  
−
* You'll receive also the signatures of (some of) your peers by mail. If you use Enigmail, you can simply right-click on the attachment and choose "Import OpenPGP key", that's it!<br>Don't forget to retrieve also your key from the keyservers as some people push directly their signature instead of sending you a mail.
  
−  
−
* Check who has signed your key:
  
−
gpglist 9AD7E3DB
  
−  
−
===Later after the signing-party===
  
−
A [http://www.paeps.cx/weblog/fosdem/fosdem_keysigning_signatures.html post of Philip on his blog] highlighted the fact that a certain amount of people don't do their homework.
  
−  
−
So I wrote a small script to see my own status:
  
−
<source lang=bash>
  
−
#!/bin/bash
  
−  
−
# Copyright: Philippe Teuwen <phil a teuwen o org>
  
−
# License: GPLv2 or later
  
−
# This requires the gpglist and caff tools provided with signing-party package
  
−  
−
##########################################################
  
−  
−
# DATE is a globbing pattern for the folders in ~/.caff/keys
  
−
# Leave * to consider all mails you've sent through caff
  
−
DATE="2008*"
  
−  
−
KEYID=
  
−  
−
##########################################################
  
−  
−
# If no keyid given, let's take the first one we find:
  
−
if [ "$KEYID" == "" ]; then
  
−
KEYID=$(gpg --list-secret-keys|\
  
−
awk '/^sec/{sub(/.*\//,"",$2);print $2;exit}')
  
−
fi
  
−
WHODIDSIGN=/tmp/who-did-sign-$$
  
−
WHODIDUPLOAD=/tmp/who-did-upload-$$
  
−  
−
# Generating a temp list of those who signed my key
  
−
gpglist $KEYID |\
  
−
sed '1,/^1/d;s/^[x ]\+//;s/ .*$//' \
  
−
> $WHODIDSIGN
  
−  
−
# Getting a list of those we've only unidirectional signatures on the keyservers
  
−
wget -q -O - "http://pgp.cs.uu.nl/mk_path.cgi?STAT=$KEYID&STATS=statistics"|\
  
−
awk '
  
−
/<\/UL>/ {b=0}
  
−
/<LI>/ && b==1 {
  
−
match($0,/.*SMALL>(.*)<\/SMALL.*/,a);
  
−
print a[1]
  
−
}
  
−
/by this key/ {b=1}' \
  
−
> $WHODIDUPLOAD
  
−  
−
# Print some stats of nr I signed (via caff):
  
−
echo -n "==== Nr of people I signed: "
  
−
find ~/.caff/keys/$DATE/*.mail.1.* -type f|wc -l
  
−  
−
echo "==== Those who didn't sign me in turn: (in red the leechers)"
  
−
# Generating list of those I signed (via caff) and substracting the first list
  
−
# Displaying results, in red those leechers who uploaded your sig on their key
  
−
# but were too lazy to do their homework to sign your key
  
−
find ~/.caff/keys/$DATE/*.mail.1.* -type f -exec basename {} \;|\
  
−
grep -v -f $WHODIDSIGN|\
  
−
sed 's/\.mail\.1\./ /'|\
  
−
sort -k 2 |\
  
−
grep --color=auto -C1000 -f $WHODIDUPLOAD
  
−  
−
rm -f $WHODIDSIGN $WHODIDUPLOAD
  
−
</source>
  
−  
−
Note that the script does not take into account the fact that some people came with several keys and already signed my key with one of their keys.
  
−  
−
Here is a (cleaned) output, replacing the red flags by !! after Fosdem 2008:
  
−
<pre>
  
−
==== Nr of people I signed: 85
  
−
==== Those who didn't sign me in turn: (in !! the leechers)
  
−
99CBF9FDF4516C2D Adam Boardman
  
−
!! 28B5F4DD948F646C Adrien Kunysz (Krunch)
  
−
!! B7511409FC15DBEC Alexios Zavras (zvr)
  
−
!! 152865FB627CCF95 Bas Wijnen
  
−
!! 8F70629AC718D347 Bradley John Smith
  
−
!! 6FD13DDCD7CDE9E6 Bram Van Dam
  
−
37E950505B625015 David Vuorio
  
−
!! 103CAA693891CD0B Guido Serra (GNU_Linux sysadmin, developer)
  
−
!! 9C19DB3C039ACDF0 Jose Maria Casanova Crespo (Chema)
  
−
269CC0A1EEE120A2 Katharina Peter
  
−
8D3867D89DDB992B Luca Capello
  
−
C87C13316AA2C883 Machteld de Kok
  
−
!! 3C4DE8C0E4B48C48 Nanaea Geyer (Privat)
  
−
!! 85E7F6EC89789A18 Sebastian Noack
  
−
3048C78B7984A4FD Toni Timonen
  
−
9D9D7CE70BF3708E Xavier Lagorce
  
−
</pre>
  
 
==[[Short GnuPG reference card]]==
  
==[[Short GnuPG reference card]]==

Revision as of 22:49, 4 February 2016

French part was converted with HTML::WikiConverter::MediaWiki from my old phpwiki site

Intro

Un très bon point de départ: http://www.gnupg.org/gph/fr/manual.html

Une introduction a GnuPG(vulgaristation): http://www.vilya.org/gpg/

Mes clés

On peut les trouver un peu partout. 

   gpg --keyserver wwwkeys.pgp.net --recv-key 0x7A135F579AD7E3DB

Serveurs publics

Key Signing Coordination

http://www.biglumber.com/

Distance entre clés

Par exemple
http://keyserver.kjsl.com/~jharris/gpgwww.cgi?from=135EA668&to=9AD7E3DB
http://keyserver.kjsl.com/~jharris/gpgwww.cgi?from=449FA3AB&to=9AD7E3DB
Remplacer les IDs des clés pour essayer d'autres chemins.

Update: les URLs précédentes ne fonctionnent apparemment plus, vous pouvez essayer avec celles-ci:
http://pgp.cs.uu.nl/mk_path.cgi?FROM=135EA668&TO=9AD7E3DB&PATHS=trust+paths
http://pgp.cs.uu.nl/mk_path.cgi?FROM=449FA3AB=9AD7E3DB&PATHS=trust+paths

http://www.cs.uu.nl/people/henkp/henkp/pgp/pathfinder/mk_path.cgi?STAT=9AD7E3DB&STATS=statistics

Strong Set

Une analyse globale est disponible ici: http://pgp.cs.uu.nl/plot/
J'y suis rentré en août 2002 avec une distance moyenne de 6.9916 (merci adulau ;-)
Des analyses mensuelles sont disponibles ici: http://keyserver.kjsl.com/~jharris/ka

Date Mean dist World class From Set to ID From ID to Set Max hops Strong set Average mean

08-2002

6.9916 >1000 - - 15 14159 6.5105

11-08-2002

5.7041 >1000 - - 14 14353 6.5222

25-08-2002

5.6948 >1000 - - 14 14586 6.5327

08-09-2002

5.6979 >1000 - - 14 14797 6.5561

22-09-2002

5.6648 >1000 - - 14 14973 6.5084

06-10-2002

5.6414 >1000 - - 14 15169 6.5101

20-10-2002

5.6296 >1000 9 12 14 15370 6.5037

03-11-2002

5.5183 >1000 19 27 13 15575 6.5045

17-11-2002

5.4787 >1000 24 27 13 15787 6.5017

01-12-2002

5.4420 >1000 24 27 13 15949 6.4797

15-12-2002

5.4373 >1000 24 27 13 16174 6.4806

29-12-2002

5.3922 >1000 24 27 13 16305 6.4931

12-01-2003

5.3865 >1000 24 27 13 16474 6.4804

26-01-2003

5.2183 >1000 24 27 13 16673 6.4706

09-02-2003

5.2173 >1000 24 27 13 16951 6.4849

23-02-2003

4.7102 496 43 63 13 17338 6.4773

09-03-2003

4.7024 507 45 63 13 17620 6.4711

23-03-2003

4.6933 500 46 63 13 17861 6.4675

06-04-2003

4.6794 481 47 63 13 18197 6.6484

20-04-2003

4.6373 367 51 67 13 19075 6.6624

04-05-2003

4.6281 358 51 67 13 19372 6.6584

18-05-2003

4.6027 330 51 67 13 19641 6.6410

01-06-2003

4.6002 331 51 67 13 19833 6.6261

15-06-2003

4.5854 335 52 68 13 20095 6.6038

29-06-2003

4.5700 330 52 68 13 20305 6.5954

13-07-2003

4.5531 327 52 68 13 20602 6.5762

27-07-2003

4.5189 419 52 68 13 20814 6.5251

10-08-2003

4.4803 440 52 68 13 21025 6.4861

24-08-2003

4.4676 461 58 75 13 21333 6.4784

07-09-2003

4.4565 462 59 76 13 21487 6.4721

05-10-2003

4.4456 482 59 76 13 21843 6.4762

17-02-2008

4.4435 1761 16 91 14 40282 5.98?

--2008

4. - 0 0 0 - 6. 
#!/bin/bash
# gpg-setstats retrieves stats about the strongset & your key
REF="http://skylane.kjsl.com/~jharris/ka"
MYKEY=${1:-"9AD7E3DB"}
 
for URL in $(lynx -dump $REF|grep "$REF/200"|cut -c 7-53); do
  select q in "Stats for the ${URL#$REF}" "Skip" "Quit";do
  if [ "$q" == "Stats for the ${URL#$REF}" ]; then
    echo =======================================
    echo Retrieve infos for ${URL#$REF}:
    wget -O - -q ${URL}other.txt
    wget -O - -q ${URL}status.txt|grep "strongly connected"
    wget -O - -q $URL${MYKEY:0:2}/$MYKEY|grep "^KeyID\|^Total\|^Mean\|^Farthest"
    echo -n "World Class:"
    lynx -dump ${URL}top1000table.html|grep $MYKEY|grep -v kjsl
    echo =======================================
    break; fi
  if [ "$q" == "Skip"  ]; then
    break; fi
  if [ "$q" == "Quit" ]; then
    exit; fi
  echo test $URL
  done
done

Tips

Pour fetcher ttes les UIDs qui ont signé une clé

  for key in $(gpg --list-sigs $1|grep ^sig|cut -c 13-20|sort|uniq);
  do
   gpg --recv-key $key
  done

quintuple-agent

  eval `q-agent &`
  q-client put 9AD7E3DB -t 3600
  or directly use agpg instead of gpg

Support de OpenPGP dans KMail:


 wget ftp://ftp.gnupg.org/gcrypt/alpha/aegypten/debian/libksba0_0.4.3-1_i386.deb
 dpkg -i libksba0_0.4.3-1_i386.deb
 wget ftp://ftp.gnupg.org/gcrypt/alpha/aegypten/debian/pinentry-gtk_0.6.3-1_i386.deb
 dpkg -i pinentry-gtk_0.6.3-1_i386.deb
 wget ftp://ftp.gnupg.org/gcrypt/alpha/aegypten/debian/gpgsm_0.3.9-1_i386.deb
 dpkg -i gpgsm_0.3.9-1_i386.deb
 gpg --rebuild-keydb-caches

Editer ~/.gnupg/gpg.conf -> use-agent
Dans KMail, Settings->Configure KMail->Security->Crypto Plugins et ajouter gpgme-openpgp.so plugin.
Laisser "update URL" vide et mettre un nom comme par ex. "OpenPGP", "location": /usr/lib/cryptplug/gpgme-opengpg.so

/usr/local/bin/gpg-kmail: 

 
#!/bin/bash
launch_me(){
   eval "$(gpg-agent --pinentry-program /usr/bin/pinentry-gtk --no-grab --default-cache-ttl 1800 )"
   kmail $* --nofork
   echo $GPG_AGENT_INFO|cut -d: -f2|xargs kill
}
launch_me $* &
exit 0

Support of Enigmail in Firefox

A promising solution for webmails...
See http://www.camrdale.org/GoogleSoC.html

Paper backup of the secret keys

apt-get install paperkey
gpg --export-secret-key key_id | paperkey

GnuPG signing parties

Short GnuPG reference card

Retrieved from "https://wiki.yobi.be/index.php?title=GnuPG&oldid=9905"