John Poelstra wrote: No, you don't have to revoke it. In fact, you can remove or extend the expiration date and continue using your current key if you like. Yes, it can be done (as long as you still have the private key, of course). (I'll defer to someone that has more of a clue about the fedora account system. :) I don't know about most people, but I think it's okay to not have an expiration date on a key. You can also add one later if you change your mind. I have no expiration date on my primary key, but I do have one on the encryption subkey. -- Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Some people are like Slinkies... not really good for anything, but you still can't help but smile when you see one tumble down the stairs.

Jesse Keating wrote: I'd say that generating a revocation cert is always the first thing to do after creating a new key, whether it expires or not. You always want to be able to revoke a key if you get into a pinch for whatever reason. Just peruse the archives of the pgp and gnupg lists and notice how often someone shows up with the "I uploaded a key to the keyserver and now I've lost the key because {my hard drive died,my dog ate it,etc}, so how do I delete the key from the keyservers?" problem. :) -- Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Tact is just a mutual agreement to be full of shit. -- Spider Robinson

Nicolas Mailhot said the following on 01/03/2008 01:53 AM Pacific Time: Correct :) I looked into it more and changed the expiration by: 1) gpg --edit <key> and then option "expire" 2) gpg --keyserver pgp.mit.edu --send-keys <key> to make change public

Matt Domsch wrote: And thank you for that Matt. It should be fun. Do you want folks to send you their keys or just their key info (the output of gpg --fingerprint)? The wiki says send your key, but the command used won't send the key, just the key info. If you haven't seen it before, I'd recommend giving a look at the "Efficient Group Key Signing Method" by Len Sassaman and Phil Zimmermann, documented at http://sion.quickie.net/keysigning.txt It cuts a lot of the tediousness out of a key signing involving more than just a few people. I'd be glad to offer any help you might want in preparing for this. I've only helped organize a few key signings, but I've been using and following PGP for what seems like ages. :) -- Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ For a list of all the ways technology has failed to improve the quality of life, please press three. -- Alice Kahn, writer

On Wed, Jan 02, 2008 at 09:13:32PM -0600, Matt Domsch wrote: I've compiled the list of keys for the FUDCon keysigning. These 20 are whom I have. If you're not on this list, and still want to participate, you may, details to follow. pub 1024D/92F0FC09 2001-04-16 Matt Domsch <mdomsch(a)alum.mit.edu&gt; pub 1024D/BD113717 1997-09-19 Paul W. Frields <stickster(a)gmail.com&gt; pub 1024D/116521D9 2000-10-11 David Woodhouse (Insecure work key) <dwmw2(a)redhat.com&gt; pub 1024D/93054260 2001-03-22 Tom Callaway (spot) <tcallawa(a)redhat.com&gt; pub 1024D/1728D29B 2007-12-15 Lee Lorentz (WB0TRA) <lee(a)wb0tra.no-ip.org&gt; pub 1024D/CCAF484E 2007-04-17 Ricky Zhou <ricky.zhou(a)gmail.com&gt; pub 1024D/99B1F444 2006-04-02 G. Wolfe Woodbury <ggw(a)wolves.durham.nc.us&gt; pub 1024D/7BB612C9 2001-06-02 Kevin Sonney (The Alchemist) <kevin(a)sonney.com&gt; pub 1024D/8929CFFC 2006-12-05 Chris Tyler <chris(a)tylers.info&gt; pub 1024D/ED00D312 2000-06-21 Douglas E. Warner <silfreed(a)silfreed.net&gt; pub 1536R/243A1329 1996-12-05 David Woodhouse <david(a)woodhou.se&gt; pub 1024D/2E3F0935 2007-05-29 Yaakov Nemoy <loupgaroublond(a)gmail.com&gt; pub 1024D/87EF16E8 2007-02-27 Tyler Owen <tyler.l.owen(a)gmail.com&gt; pub 1024D/7A47522D 2006-12-22 John Poelstra <poelcat(a)gmail.com&gt; pub 1024D/78688BF5 2002-10-03 Nalin Dahyabhai <nalin(a)dahyabhai.net&gt; pub 1024D/3B6A5B89 1999-09-16 Jack Neely <jjneely(a)ncsu.edu&gt; pub 2048R/BEAF0CE3 2006-07-04 Todd M. Zullinger <tmz(a)pobox.com&gt; pub 1024D/D74908ED 2007-12-31 Eric Harlan Christensen <eric(a)christensenplace.us&gt; pub 1024D/B05A59F7 2004-03-01 Dennis Gilmore <dennis(a)auroralinux.org&gt; pub 1024D/0D86AF59 2006-01-21 Jonathan Steffan (daMaestro) <jonathansteffan(a)gmail.com&gt; See the URL above for the process. Before the keysigning, you _must_ download a copy of http://domsch.com/linux/fedora/fudcon2008/fudcon-keysigning.txt and verify that your key is correct on there. You'll be asked at the keysigning to confirm that your key is correct in that file. Second, you must run both sha1sum and md5sum on the fudcon-keysigning.txt file, and validate that it in fact matches: http://domsch.com/linux/fedora/fudcon2008/fudcon-keysigning.txt.md5sum 0c799b9b70cf87e0039631e0cfd1586a fudcon-keysigning.txt http://domsch.com/linux/fedora/fudcon2008/fudcon-keysigning.txt.sha1sum d3fa0cda1d77cde8608c2506e88cb3cd60764c43 fudcon-keysigning.txt At the keysigning, I'll read these values. Everyone confirms they match, therefore we know your key as listed in the keyring is what everyone expects it to be. Then we each, in order, show our IDs for everyone to validate, and then each person can decide if they want to sign that person's key. After the keysigning, you can use a tool like caff from the pgp-tools package to sign each person's key and mail it to them. I'll see you all next Saturday! Thanks, Matt -- Matt Domsch Linux Technology Strategist, Dell Office of the CTO linux.dell.com & www.dell.com/linux

Matt Domsch wrote: I'd like to put in a plug for not using caff (read: I'm a pedant ;). There are three things you want to verify when you certify (sign) a key: 1) The identity of the person asking me to certify their key. 2) The key's fingerprint, id, size, and type 3) The email address(es) associated with the key 1 can be accomplished via a drivers license or other form of ID. 2 is achieved by checking that the key info presented at the signing matches what is available on the public keyservers 3 is the trickier one. When you sign a key, you are signing the primary key + the user id(s). Most newer PGP keys consist of a primary key and one or more encryption subkeys. Using caff as I understand it, you would sign each uid on a key and then encrypt it to the address on the uid. This encryption is intended to verify that the key actually belongs to the recipient and that they can receive email add the address on the key. This is not entirely adequate for a few reasons. Firstly, it doesn't really verify that the uid you are signing belongs to the person at the address (see below). Secondly, it fails completely for anyone that doesn't have an encryption subkey. (Some people have a master key that they use for signing and for acquiring signatures on and another key that they use for day to day use and receiving encrypted mail. Not common perhaps, but a perfectly valid usage of gpg, and no reason to deny someone a signature on their key.) What you really want to do is ask the key owner to sign some text or data of your choosing and send it to you. That ensures that the thing you are signing (the primary key + uid) is under the control of the key owner and that they can receive mail at the address in the uid. I prodded the folks on gnupg-users about this a year or so ago. You can read the full thread starting at[1] and David Shaw's assertion that "sending an signed key via encrypted mail does not ensure anything about the key owner." at[2]. Ingo Kloecker was kind enough to post a short perl script in that thread that he used to send out challenge mail after a keysigning. I modified it a bit and used it after the last keysigning at my local LUG (all the bugs are surely mine). In the off chance that anyone is interested, I've posted that script at[3]. It requires the perl modules Text::Autoformat and Text::Template (among other standard modules). [1] http://marc.info/?l=gnupg-users&m=115221259531231&w=2 [2] http://marc.info/?l=gnupg-users&m=115230714808866&w=2 [3] http://tmz.fedorapeople.org/scripts/gpg-send-challenges -- Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eat drink and be merry, for tomorrow they may make it illegal.

PWF> If I may be so bold, last time we did this, a very small PWF> proportion of attendees actually sent around signed keys. Yeah, I found that I got back home, got busy putting out fires and such (plus my wife decided that we should buy a new car on the way home from the airport) and I ended up forgetting what I was supposed to do to do all of the signing. I haven't sent my key info in this time out of embarrassment. - J<

On Monday 07 January 2008, Jason L Tibbitts III wrote: I missed the gpg session last time sine i had to do the EPEL presentation. however it would be good to get some of it done while there. perhaps we could have the session at a time by itself. at the beginning or end of the day. Dennis

I wrote: I suppose the actual graph would be handy to have too. :) http://tmz.fedorapeople.org/fudcon9-keysigning/fudcon-graph.png -- Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ You will rue this day! Well, go on! Start ruing! -- Stewie Griffin

On 07 Jan 2008 23:38:09 -0600, Jason L Tibbitts III <tibbs(a)math.uh.edu&gt; wrote: They're on the wiki now, and pretty much exactly that :)

On Thu, Jan 03, 2008 at 09:50:09AM -0500, Douglas E. Warner wrote: OK, for that, yes, there will be a bottle of something on hand, most definitely. :-) -- Matt Domsch Linux Technology Strategist, Dell Office of the CTO linux.dell.com & www.dell.com/linux