NANOG Web
Back to: NANOG Home

PGP Key Signing Party

Notes from Joe Abley

We will be holding a PGP Key signing party at the NANOG 28 meeting in Salt Lake City, Utah. We have been scheduled to meet on Monday, June 2, after the BOFs at 9pm (if the BOFs run on, we'll maybe delay a little) in the Smoke House room (really.)

The procedure we will use is the following:

1. People who wish to participate should email an ASCII extract of their PGP public key to <jabley@isc.org> by noon on Monday, June 2, 2003. Please include a subject line of "NANOG PGP KEY", and please avoid MIME-encrypting your e-mail. (I will be running the entire mail folder file through PGP, and PGP-keys that are base-64 encoded will get ignored unless I take manual action to fix things. I will try do the manual fixup, but I make no guarantees about catching all of them.)

   The method of generating the ASCII extract under Unix is:

   pgp -kxa my_email_address mykey.asc	(pgp 2.6.2)
   pgpk -xa my_email_address > mykey.asc	(pgp 5.x)
   gpg --export -a my_email_address > mykey.asc	(gpg)

   If you're using Windows or Macintosh, hopefully it will be Intuitively Obvious™ using the GUI interface how to generate an ASCII armored key that begins:

   -----BEGIN PGP PUBLIC KEY BLOCK-----

2. By 6pm on Monday, you will be able to fetch a complete key ring with all of the keys that were submitted.
3. At 9pm, come prepared with the PGP Key fingerprint of your PGP public key; we will have handouts with all of the key fingerprints of the keys that people have mailed in.
4. In turn, readers at the front of the room will recite people's keys; as your key fingerprint is read, stand up, and at the end of reading of your PGP key fingerprint, acknowledge that the fingerprint as read was correct.
5. While everybody is in the room together, it's a good chance to verify the identities of people whose key fingerprints you have checked, if you don't already know them personally. You might want to bring photo id with you (drivers licence, passport, etc) to make it easier for other people to confirm your identity.
6. Later that day, or perhaps when you get home, you can sign the keys corresponding to the fingerprints which you were able to verify on the handout; note that it is advisable that you only sign keys of people when you have personal knowledge that the person who stood up during the reading of his/her fingerprint really is the person which he/she claimed to be.
7. Submit the keys you have signed to the PGP keyservers. A good one to use is the one at MIT: simply send mail containing the ascii armored version of your PGP public key to pgp@pgp.mit.edu.

Note that you don't have to have a laptop with you; if you don't have any locally trusted computing resources during the key signing party, you can make notes on the handout, and then take the handout home and sign the keys later.