Formal Keysigning

Signing other people's GnuPG/PGP keys and having them sign yours is a way of expanding the Web Of Trust, which makes GnuPG/PGP more useful. People you may not have met trust the signatures on your key, and so trust your key. In turn, you can trust keys that have signatures of people you trust. The Web Of Trust is how we accomplish the fourth factor of authentication: Someone who knows you.

Purpose

A keysigning is not meant to establish your absolute, one true, Real Name™ identity, it is merely to associate a keyID with your identity. The identity you use is up to you, as published in the UserID portion of your GnuPG/PGP key. It could be only an e-mail address, a nickname, or even your real name. It's how people identify you in correspondence, or associate you as the author of a document or software. By signing your key, people verify that the KeyID is associated with the identity by which they know you.

A formal keysigning is a way to expand the Web Of Trust to include people whose keys you might not otherwise sign (because you don’t know them very well, or they only have ID issued by an authority you don’t like). With all these introductions and vouchings the chance of someone misrepresenting their identity is vanishingly small, so you can trust that the key fingerprint they read is really associated with that person.

Concepts

Four factors of authentication:

1. Something you know (passphrase)
2. Something you own (key fob, pass card)
3. Something you are (fingerprint, retinal scan)
4. Someone who knows you (trusted introducer)

A keysigning party increases the Web of Trust, or the number of trusted introducers who will vouch for the association of your identity with your KeyID.

Preparations before the Keysigning Party

ToDo for the KeyMaster

1. Generate Keysigning Key

   gpg --gen-key

   • This can be a Sign Only key
   • Use the Real Name field to identify this Keysigning event, eg. "KWLUG Keysigning 2013-12-02"
   • Doesn't need an e-mail address
   • Use the Comment field for a URL to the keysigning Web site
2. Export the Keysigning Public Key

   gpg --armour --export 0xKEYID > keysigning-public-key.asc

   • Also upload the Keysigning Public Key to the keyservers
3. Create a Keysigning Keyring, add the Keysigning Public Key

   gpg --no-default-keyring --keyring ./keysigning-keyring --import keysigning-public-key.asc 

4. Make the Keysigning Keyring publicly available. This keyring will also contain the public keys of the keysiging participants.
5. Collect the public keys that people send to you in encrypted, signed e-mail, add them to the Keysigning Keyring

   gpg --no-default-keyring --keyring ./keysigning-keyring --import alicepublickey.asc bobpublickey.asc carolpublickey.asc

   • Remember to update the published Keysigning Keyring!
6. Immediately before the keysigning create a Fingerprint List of all the KeyIDs, UserIDs and fingerprints in the keyring. Make sufficient copies for all participants.

   gpg --no-default-keyring --keyring=./keysigning-keyring --fingerprint > fingerprintlist.txt

   • The KeyMaster can send fingerprintlist.txt to all participants in an encrypted, signed e-mail, or participants can download the keyring and print their own
   • The Keysigning Key should be the first key on the list. Document editing might be necessary.

ToDo for the Participants

1. Add your key to the Keysigning Keyring
   1. Export your Public Key

       gpg --export 0xYOURKEYID > MyPublicKey.gpg

   2. Get a copy of the Keysigning Keyring
      • Either download it, or request that the KeyMaster e-mails it to you
   3. Add your public key to the Keysigning Keyring

      gpg --no-default-keyring --keyring ./keysigning-keyring --import MyPublicKey.gpg

   4. Submit the updated keysiging keyring (Either upload it, or e-mail it to the KeyMaster).
2. OR E-mail your public key to the KeyMaster, let him do the work.

At the Keysigning Party

1. KeyMaster distributes the Fingerprint List
2. KeyMaster asks each participant on the Fingerprint List to make a Formal declaration

   Bob: "I'm Bob Jonkman, the User ID on my key is bjonkman@sobac.com and my GnuPG fingerprint is 04F7 742B 8F54 C40A E115 26C2 B912 89B0 D2CC E5EA"

3. The KeyMaster asks for others to vouch for the participant:

   Alice: "I've known Bob since the early days, and that's really him"

4. Everyone marks on their copy of the Fingerprint if they're sufficiently convinced that the participant really owns the key with that fingerprint.
5. The KeyMaster repeats the process until all participants have made their declarations and been vouched for.

After the Keysigning Party

Participants

1. Download the Keysigning Keyring
   • or download each individual key from the keyserver, or get it directly from the owner
2. Import the keys from the Keysigning Keyring into your keyring

   gpg --import keysigning-keyring

3. Verify that the key fingerprint matches for each participant you've checked off, only then:
4. Sign the Public Key for each participant you've checked off.
   • Also sign the Keysigning Public Key (optional, but creates a convenient record of participants)

   gpg --sign-key 0xParticipantID

5. Send each signed Public Key to its owner by e-mail, with copy to the KeyMaster.
   • DO NOT upload other people's keys to the keyservers without their permission!

    gpg --armor --output 0xParticipantID.signed-by.0xYourID.asc --export 0xParticipantID

KeyMaster

1. The KeyMaster signs each participant's key with the Keysigning Secret Key to verify they've participated.
2. The KeyMaster updates the Keysigning Keyring with all the signed keys.
3. The KeyMaster expires the Keysigning Key to close the keysigning event.

---

See Also:

Informal Keysigning