GnuPG

Notes on signing-parties

There are some useful tools in Debian:

apt-get install signing-party

Here is an example based on my participation to the keysigning-party of FOSDEM 2008

• Importing keys: the organizer provided a file with all the keys exported

tar xzvf keys.tgz
for i in keys/*; do gpg --import $i;done

• Preparing the given list of keys: the organizer provided a list such as in the examples provided here: /usr/share/doc/signing-party/gpgsigs/examples/. To prepare that file, compute its checksums and add the pictures when possible:

gpgsigs --latex 9ad7e3db ksp-fosdem2008.txt ksp-fosdem2008
latex ksp-fosdem2008
dvips ksp-fosdem2008.dvi
ps2pdf ksp-fosdem2008.ps > ksp-fosdem2008.pdf

• Preparing a stock of our own fingerprints, in case of...

gpg-key2ps 9ad7e3db |ps2pdf - 9ad7e3db.pdf

After the signing party

• I clean the list ksp-fosdem2008.txt to keep only those I met.
• I extract the fingerprints

cat ksp-fosdem2008-ok.txt |grep fingerprint|sed 's/^.*= //;s/ //g'> ksp-fosdem2008-finger.txt

• I configure caff, the first time it creates a template in ~/.caffrc which was nearly ok, I let only my usual public key, told to encrypt also for that key, activated the default email template, chose agpg as signing gpg program and finally chose a public keyserver:

$CONFIG{'local-user'} = [ qw{7A135F579AD7E3DB} ];
$CONFIG{'also-encrypt-to'} = [ qw{7A135F579AD7E3DB} ];
$CONFIG{'gpg-sign'} = '/usr/bin/agpg';
$CONFIG{'keyserver'} = 'wwwkeys.pgp.net';

• I could not get caff working until I finally copied ~/.gnupg/pubring.gpg and ~/.gnupg/trustdb.gpg to ~/.caff/gnupghome/ then everything worked including import of new keys from the keyserver.
• Signing only:

caff --no-download --no-export-old --no-mail $(cat ksp-fosdem2008-finger.txt)
yes / save (check twice the uids as you could have forgotten to remove it in ksp-fosdem2008-ok.txt)

• Sending emails:

caff --no-download --no-sign --no-export-old $(cat ksp-fosdem2008-finger.txt)

• I got some undeliverable emails, some obviously being jabber ids, so I recovered the email content from ~/.caff/keys/2008-02-24 and sent it over jabber.

• Short way for a professional signing-party using an internal keyserver:

for i in 96C896AC A66BEE0A 1123D169 FE26A072 FB3D346D EA7164CE; do 
   gpg --recv-key $i;
   agpg -u teuwen@nxp --sign-key $i;
   gpg --send-key $i;
done

• In case you mistype your passphrase with quintuple-agent (agpg), you've to delete the stored passphrase before trying again:

q-client list
q-client delete 54C12701

• Check who has signed your key:

gpglist doegox