Signing Party
From NeoWiki
There will be a List Based PGP key Signing Party at NeoCon so we can expand our non-existent web of trust. But why? We shall sign keys today so we can sign documents (or files) digitally in the future. The possibility to encrypt documents is just a bonus included in the deal kinda like the pickle that comes with your hot dog.
If you are a server administrator, IRC idler, Linux user, encryption enthusiast, or general troublemaker follow the directions on this page then come to our Signing Party to expand (y)our web of trust.
Please read this page fully including the paranoia section before you start your journey into the world of Signing Parties.
Also, since this is contained inside a wiki, feel free to modify/edit to suit your flavor of propaganda dissemination.
Contents |
[edit] Goal
My goal is to create a non-technical, less wordy, Neoturbine-specific version of The Keysigning Party HOWTO with lots of screenshots. This will allow a maximum number of people to participate.
[edit] still left todo
- use less words to convey the same message
- working on it
- add a glossary of terms
- 'finalize' and fix this page/list
- add link to this page in the invitations
- try to convince people that a signing party is useful ;)
[edit] Software Used (and abused)
The software used in this guide:
- Gpg4Win - collection of various tools including WinPT and GnuPG that make it work/look/act like classical PGP products
- We will mainly use WinPT.
- GnuPG - cross platform CLI implementation of OpenPGP
- This software's use remains the same on all operating systems.
- Other softwares that implement the OpenPGP standard (or provide GUIs for GnuPG) exist but were not included for sake of sanity.
[edit] GPG4Win
[edit] Obtaining and Installing software
We will be using Gpg4Win (GUI) which also includes GnuPG (CLI).
- The most basic installation of Gpg4Win is as follows:
- Download software and double click to install
- If you want a separate MUA (Mail User Agent) for encrypted communications you must select Claws-Mail at Installation
- The manuals are not needed since they are available online. The German manual (if you require it) can easily be translated by the numerous free online translation services.
- Finish the installation by clicking "Next" a few more times then "Finish".
[edit] Generating a key
Open WinPT. It will automatically load to the Windows systemtray.
Detailed Directions for Figure 3
- Leave the "Key type" at its default setting
- The "Subkey ..." text box determines the size of your encryption (ELG -- Elgamal) key only
- Setting an "Expire date" is useful because memories fade (you might forget your passphrase) and the longer you use the same key the more likely your passphrase will be compromised. I'd choose a date in the not to distant future.
- If you wish to remain pseudoanonymous so use your nickname instead of a "Real name".
- Once you have completed entering in data click "Start"
The pass phrase must be large because it's the weakest part of your key. A brute force attack is possible with current clustered computers on small (less than 25 chars) passphrases (its even easier/faster if someone gets a hold of your private key.) This program will warn you if you enter one less than 8 characters long.
It will now start generating your key. The time it takes to complete this will depend on how much random data is available and how large you choose your key to be.
WinPT will then ask if you would like to backup your keyrings and you should do so as long as you know that those backups will not be compromised.
[edit] Where do I find the KeyID?
[edit] Uploading a key
[edit] Obtaining and signing keys
When you finally get back home make sure that your computer has not been compromised, get everyone's key, sign everyone's key, and upload each signed key to the key server.
[edit] Obtaining Keys
[edit] Signing and uploading Keys
- Repeat the above steps for all the identities you verified at the party.
[edit] GnuPG
The command line interface is pretty straight forward to use so don't be turned off by it.
[edit] Obtaining and Installing software
GnuPG is installed on default in many distributions (especially those that use signed packaging). Because installation varies slightly depending on your distribution (due to packaging) refer to distro-specific documentation. Installing from source is another possibility but its beyond the scope of this document. Detailed installation instructions for Windows are available above.
[edit] Generating a key
Run the following command which will allow you to interactively generate a keypair.
gpg --gen-key
The output will look something like this:
Please select what kind of key you want:
(1) DSA and Elgamal (default)
(2) DSA (sign only)
(5) RSA (sign only)
Your selection? 1
DSA keypair will have 1024 bits.
ELG-E keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 2048
Requested keysize is 2048 bits
Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y
You need a user ID to identify your key; the software cons
tructs the user ID
from the Real Name, Comment and Email Address in this form
:
"Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.d
e>"
Real name: Mary Ann Sylvan
Email address: mas@example.org
Comment:
You selected this USER-ID:
"Mary Ann Sylvan <mas@example.org>"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
You need a Passphrase to protect your secret key.
The sections that you need to fill out have been bolded in this example.
[edit] Where do I find the KeyID?
The following will print all the keys in your keyring with the short format keyid.
gpg --list-keys --keyid-format short
The output of this command will look something like:
pub 1024D/18F9BD44 2008-05-14 uid Mary Ann Sylvan <mas@example.org> sub 2048g/A43F0FAA 2008-05-14
The KeyID of "Mary Ann Sylvan <mas@example.org>" is the hexadecimal number (18F9BD44) next to the key's info. Generally, the primary KeyID is used to refer to the key instead of the sub key (A43F0FAA in this example) which has its own KeyID.
The following command will print the given KeyID's fingerprint
gpg --fingerprint 18F9BD44
This will produce an output similar to:
pub 1024D/18F9BD44 2008-05-14
Key fingerprint = 09EE 4976 337F 74F9 D60A BF5E EC45 C6B3 18F9 BD44
uid Mary Ann Sylvan <mas@example.org>
sub 2048g/A43F0FAA 2008-05-14
The Key fingerprint is clearly outputted.
[edit] Uploading a key
gpg --keyserver hkp://subkeys.pgp.net --send-keys 18F9BD44
This will send the key with KeyID "18F9BD44" to a keyserver subkeys.pgp.net.
[edit] Obtaining and signing keys
When you finally get back home make sure that your computer has not been compromised, get everyone's key, sign everyone's key, and upload each signed key to the key server.
[edit] Obtaining Keys
Use the keyID that the key owner gave you in real life. Do not blindly trust the keyIDs given in the wiki. Remember that a wiki can be modified for malicious purposes.
GnuPG can import keys using multiple methods. For more detailed directions refer to the texinfo or the manual page for gpg.
[edit] Receive Keys from Keyserver
This method allows you to import multiple keys without much hassle.
gpg --keyserver hkp://subkeys.pgp.net --recv-keys <keyids separated by spaces>
Note: hkp://subkeys.pgp.net is round robin to many key servers. If someone's key has not been propagated you will need to ask the owner for a specific key server to use.
[edit] Import from file
gpg --import <filename containing key>
[edit] Get keys from URI
If you know a full path on a (key)server that has a key this will be a useful option for you. Livejournal, for example, allows users to upload keys which gpg can then import without the need to save it to the disk beforehand.
gpg --fetch-keys path://to/key
[edit] Signing Keys
gpg -u <your key's keyid> --sign-key <keyid>
Repeat this step for each of the keys you wish to sign.
[edit] Uploading Signed Keys
After you have signed all the keys that you wanted to sign send them back to a server.
gpg --keyserver hkp://subkeys.pgp.net --send-keys <keyids sperated by spaces>
[edit] Party Time
[edit] Creating/obtaining a list of participants
Here is a list of participants. When NeoCon nears this list will become finalized (probably as a csv or pdf) and it should be available at NeoCon but don't trust us. Don't forget to add your own name. At the very least include your name and KeyID. You might also want to include your key fingerprint.
[edit] An informal list of participants
- Sahal, 3710BD9A
- echoline, 2B02D6DE
- Joe (sargas)
- stiv2k, 5C4D079C
[edit] Detailed Directions
At the party armed with a list and a pen you should be able to fill out the necessary lines.
- Go up to Someone.
- Say "Hello you fool! What's going on man?"
- Indicate that you are looking to verify her identity.
- Pull out papers or share secrets.
- Once you are sure you are talking to the key holder indicate it on your list.
- Repeat until you have verified everyones identity.
- Enjoy Neocon!
[edit] Paranoia
It is important to know the flaws of using any particular technology because a false sense of security is useless. Please feel free to include your own delusions of grandeur and debunk myths.
[edit] Basics
The user must be sure that her operating system has not been compromised. If an OS has been compromised, encryption/signatures/authentication is useless. Verifying this may be as simple as running a virus scan or as complicated (time consuming) as Linux From Scratch or Gentoo Linux depending on your level of free time/paranoia. Even in the latter cases there is an issue of trusting your compiler, even if you trust the source. This test must be conducted at multiple random intervals whenever the user is feeling paranoid.
Watch out for hardware key loggers which are cheap and relatively hard to spot. They usually plug into the back of the keyboard but can also be inside the keyboard itself or inside the case between the jack and the motherboard.
Always encrypt text on-the-fly instead of using temporary files. Plain text copies will lurk on hard drives (NTFS, FAT, ext3 do not delete files) after deletion. If you must create temporary files make sure to have a high turnaround rate so files get overwritten quickly. Using a low capacity hard drive is good (find them while dumpster diving or buy a cheap low capacity SD card) but so is running some kind of p2p server (maybe a ftp topsite, freenet node, or middle (non-exit) tor node) on a larger hard drive.
Also do not save encrypted documents with detailed filenames (choose names at random) because file systems might keep a list of file names even after files are deleted.
A Linux LiveCD, such as Incognito (no longer maintained) or amnesia can be used to encrypt data without worrying about leaving traces on the hard disk.
The cost of small high quality spy cameras (some as low as $20 shipped) is very little compared to the information/trust that might be lost/gained.
Electromagnetic Radiation put out by your CRT or LCD might be used to spy on you. The only way to protect from this is adequate shielding. US Government TEMPEST documents are also full of related paranoia. See: Gene Hackman's character in Enemy of the State.
[edit] Binaries, Trust, and Governments
Gpg4win provides a unified installer for Windows-specific GPG related software. It is a project that was started by the Federal Office for Information Security of the German Government. The user must have faith that this group did not infect the binaries. The user can always get binaries from more trustable sources or compile them herself from source.
Windows itself cannot be trusted because only binaries are provided. Do you trust that Microsoft (the largest distributor of software) and the US Government have not entered into secret agreements? This is the same Government that has forced various internet and telecommunication providers to collect, process, and submit massive amounts of information.
The US Government has recently used malicious software to gain passphrases. These softwares cannot be detected by anti virus softwares simply because the companies refuse to rebel, mass distribution of these softwares cannot be verified, and the software used is not known. See Magic Lantern (software)
[edit] Hardware
Does the user trust her chip or harddrive manufacturer? The man page for wipe 0.20 provides paranoia:
Be aware that harddisks are quite intelligent beasts those days. They transparently remap defective blocks. This means that the disk can keep an albeit corrupted (maybe slightly) but inaccessible and unerasable copy of some of your data. Modern disks are said to have about 100% transparent remapping capacity. You can have a look at recent discussions on Slashdot. I hereby speculate that harddisks can use the spare remapping area to secretly make copies of your data. Rising totalitarianism makes this almost a certitude. It is quite straightforward to implement some sim- ple filtering schemes that would copy potentially interesting data. Better, a harddisk can probably detect that a given file is being wiped, and silently make a copy of it, while wiping the original as instructed. Recovering such data is probably easily done with secret IDE/SCSI com- mands. My guess is that there are agreements between harddisk manufac- turers and government agencies. Well-funded mafia hackers should then be able to find those secret commands too. Don't trust your harddisk. Encrypt all your data. Of course this shifts the trust to the computing system, the CPU, and so on. I guess there are also "traps" in the CPU and, in fact, in every sufficiently advanced mass-marketed chip. Wealthy nations can find those. Therefore these are mainly used for criminal investigation and "control of public dissent". People should better think of their computing devices as facilities lended by the DHS.
[edit] Mathematics
If the user believes an easy way to factor extremely large integers exists she should not use key types that rely on them.
If the user doesn't trust / cannot verify that she is getting random (can randomness be verified?) data from her OS or otherwise she cannot trust that any generated keys are sufficiently secure.
Do computers (computer clusters) exist that are powerful enough to brute force quickly?
Chapter 3 of Handbook on Applied Cryptography explains many of the mathematical problems related to public key encryption.
[edit] Keep Reading
Specific Help
- The TexInfo and reference manual pages of GnuPG can be accessed via
info gpgorman gpg - The GNU Privacy Handbook
- The Keysigning Party HOWTO
- HOWTO prep for migration off of SHA-1 in OpenPGP
- A list of Public Key Servers
About Randomness
- Get some randomness
- Gather randomness from non-broadcasting radio frequencies inputted into your sound card
General information about Encryption
- http://cm.bell-labs.com/who/ken/trust.html
- Weaknesses in Public-key cryptography on Wikipedia
- Handbook of Applied Cryptography
- Cryptology by Albrect Beutelspacher.














