[lkml]   [2011]   [Sep]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    From status: establishing a PGP web of trust
    Hash: SHA1

    Hi all,

    Since the status announcement last week a number of you
    have contacted me about re-establishing credentials. In order to
    establish a proper PGP web of trust we need keys that are cross-signed
    by other developers. As such, we ask that you follow the following

    1. Make sure your systems are uncompromised. We will address specific
    recommended steps for that in a separate email.

    2. Create a new PGP/GPG key, and also generate a key revocation
    certificate (but don't import it anywhere -- save it for the
    future) for your new key. In the near future we are considering
    setting up an escrow service for key revocation certificates.

    I recommend using a 4096-bit RSA key. Given how fast computers are
    these days, there is no reason to use a shorter key. DSA keys
    should be considered obsolete; substantial weaknesses have been
    found in DSA.

    $ gpg --gen-key
    $ gpg -u <key ID> -o <key ID>.revoke --gen-revoke

    3. If you are reasonably certain that your old key has never been
    jeopardized, sign the new key with the old key.

    $ gpg -u <your old key ID> --sign-key <your new key ID>

    If you are *not* sure about your old keys, please revoke them if
    you haven't already done so (create a revocation certificate and
    import it into your keyring, then push the key to the key servers.)

    $ gpg -u <your old key ID> -o <your old key ID>.revoke --gen-revoke
    $ gpg --import <your old key ID>.revoke
    $ gpg --keyserver --send-key <your old key ID>

    4. Upload the signed keys to the keyserver system (I usually use, but most of the keyservers sync with each other with
    roughly a 24-hour delay.) By publishing the keys we make them
    available not only to but for other uses, like signing
    email, and you can verify yourself by looking at
    if there is someone out there who has published a key with your name
    on it. Furthermore, it allows us to tap other webs of trust already

    $ gpg --keyserver --send-key <your key ID>

    5. Get as many other kernel developers that you have physical access to
    to sign your key after verifying the fingerprint. Verifying keys
    over the phone is OK if and only if you know them *extremely* well;
    think "would I be willing to testify in court that the person I
    talked to was X"?

    If you work in an office with multiple other Linux developers, it
    would be a very good thing to organize a local key signing. We will
    do a key signing at Kernel Summit for the core kernel developers.

    A web site with recommendations for running a key signing:

    $ gpg --fingerprint <key ID>
    $ gpg --keyserver --recv-key <their key ID>
    $ gpg -u <your key ID> --sign-key <their key ID>
    $ gpg --keyserver --send-key <their key ID>
    $ gpg --keyserver --recv-key <your key ID>

    6. Please send me the key identifier and fingerprint to
    <>. This is a temporary address until the
    MX is ready to put back online; eventually we will probably have a
    web form interface for this.


    Version: GnuPG v1.4.11 (GNU/Linux)
    Comment: Using GnuPG with Mozilla -

    -----END PGP SIGNATURE-----

     \ /
      Last update: 2011-10-01 01:53    [W:0.024 / U:12.960 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site