1 % Supplemental Keysigning Help

2 %

3 % markus schnalke <meillo@marmaro.de>

4 %

5 % since 2009-02-17

6

7 \documentclass[a4paper,twocolumn]{article}

8

9 \usepackage{paper}

10

11 \usepackage{url}

12 \usepackage{graphicx}

13 \usepackage{verbatim}

14

15

16 \begin{document}

17

18 \date{}

19 \title{\textbf{\huge Supplemental Keysigning Help}}

20 \author{markus schnalke\\meillo@marmaro.de}

21 \maketitle

22

23 \copyright{

24 Created for some people of the LUG Ulm \cite{lugu}, 2009-02-18\\

25 This document is available on my website \url{http://marmaro.de/docs}\,.

26 }

27

28

29 \abstract{

30 Methods to organize keysigning events are available in large numbers. They usually describe only what needs be done in which order, and this is exactly what they should do.

31

32 This document is a supplemental help to one of the methods by describing concrete ways how to actually do some of the tasks. It suggest tools and shows how to use them.

33 }

34

35

36

37 \section{Introduction}

38

39 This document tries to help people in organizing a keysiging event. It should be seen as concrete suggestions for how to do things that are already described by the keysigning method in general. The method defines how to organize the keysigning, this document makes concrete suggestions \emph{how} to do things. This document also shows how to generate WOT graphs.

40

41

42

43

44 \section{Keysigning method}

45

46 The keysigning method that is focused here is Zimmermann and Sassaman's method \cite{zimmermann}. It is easy to use and scales well for any amount of people.

47

48 One should become familiar with this method and follow it when organizing a keysigning event. This document provides technical help with some selected tasks.

49

50

51

52

53 \section{Key management}

54

55 When you invite people to the keysigning event you will receive their public key(s). To manage the keys it is recommended to add them to a new keyring:

56

57 {\tt\small

58 \begin{verbatim}

59 $ gpg --no-default-keyring \

60 --keyring /path/to/keyring.gpg \

61 --import some-public-key.asc

62 \end{verbatim}

63 }

64

65 It is also possible to directly fetch the keys from a keyserver, but this is not preferred. It is better to receive the keys directly from the owners.

66

67 {\tt\small

68 \begin{verbatim}

69 $ gpg --no-default-keyring \

70 --keyring /path/to/keyring.gpg \

71 --keyserver subkeys.pgp.net \

72 --recv-key 0xDEADBEEF

73 \end{verbatim}

74 }

75

76

77

78

79 \section{Participant list}

80

81 You have to generate a list that contains the public keys of all participants. A script to do this automatically with nice formating is available \cite{keylist}. The script is not perfect, but sufficient.

82

83 {\tt\small

84 \begin{verbatim}

85 $ keylist.sh /path/to/keyring.gpg header.txt \

86 howto.txt checksums.txt

87 \end{verbatim}

88 }

89

90 The script generates a public key list from all keys in the keyring (first argument). This list can get prepended by the contents of text files (all further arguments).

91

92 A general header is demanded by good style. Descriptions of what the participants need to do are highly recommended in order to support unexperienced participants. Fields to insert the checksums should be provided anyway. Examples for the here included files can be found at \cite{keylist}.

93

94 %Figure \ref{fig:keylist} shows a sample participant list.

95

96 \begin{figure}

97 {\tt\tiny

98 \verbatiminput{keylist-sample.txt}

99 }

100 \label{fig:keylist}

101 \caption{A sample participant list}

102 \end{figure}

103

104

105

106

107 \section{WOT graphs}

108

109 The change of the Web of Trust (short: WOT) does directly show the gain of a keysigning event. The more interweaved and the shorter connections between individuals are, the better is the trust among that group of people.

110

111 Providing WOT graphs is a nice act of a keysigning organizer. However, it is in any case optional and can be done afterwards, too.

112

113 Two programs are required to generate the graphs: \texttt{sig2dot} \cite{sig2dot} and \texttt{neato} from \texttt{graphviz} \cite{graphviz}.

114

115 To generate a graph that depicts the WOT, use the following command:

116

117 {\tt\small

118 \begin{verbatim}

119 $ gpg --no-default-keyring \

120 --keyring /path/to/keyring.gpg \

121 --list-sigs \

122 | sig2dot -d YYYY-MM-DD \

123 | neato -Tpng > wot.png

124 \end{verbatim}

125 }

126

127 The date (`\texttt{YYYY-MM-DD}') must be substituted, of course. The generated image shows the WOT at the given date.

128

129 To generate graphs of the WOT after the event, one must update the keyring first:

130

131 {\tt\small

132 \begin{verbatim}

133 $ gpg --no-default-keyring \

134 --keyring /path/to/keyring.gpg \

135 --keyserver subkeys.pgp.net \

136 --refresh-keys

137 \end{verbatim}

138 }

139

140 New images can be created the same way as described above, only the date needs to be changed.

141

142 (Notice that only signatures that were uploaded to a keyserver will be included.)

143

144 %Figure \ref{fig:wot-graphs} shows sample WOT graphs before and after a keysigning event.

145

146 \begin{figure}

147 \includegraphics[scale=0.45]{wot-before.ps}

148 \hfill

149 \includegraphics[scale=0.45]{wot-after.ps}

150 \caption{Sample graphs which show the WOT before and after a keysigning event}

151 \label{fig:wot-graphs}

152 \end{figure}

153

154

155

156 \section{A hint for participants}

157

158 Receiving keys, signing them, and sending the signatures back to the key owners can be a wasteful job, especially if may people took part in a keysigning event.

159

160 The nice tool \texttt{caff} \cite{signing-party} is a great helper. It automates the whole process, from key retrival, to signing, to sending the signatures. (An MTA is required to send signatures.)

161

162

163

164 \section{Acknowledgments}

165

166 This document bases heavily on how Fabian Fingerle \cite{fabianfingerle} organizes keysigning events. I thank him for being a great inspiration.

167

168

169

170 {\footnotesize

171 \bibliographystyle{plain}

172 \bibliography{references}

173 }

174

175

176

177 \end{document}

178