Re: How can I have my GPG public key signed by a CA?

Idea for a meetup?

How about we have a discussion about cryptography and do key signing at a
Meetup? Someone has volunteered to try and reserve a room at Hacker Dojo
for us to hold a meetup. I'll be happy to kind of moderate a discussion and
show a few slides as an intro to public-key and symmetric-key cryptography
and GPG.

Rick Moen, Akkana Peck, Robert Freiberger willing to participate?

Anyone else interested in participating?

What do folks need to bring to and do ahead of time to participate in a
key-signing party? I've never been to one.

-kevin


On Tue, Apr 16, 2019 at 11:45 AM Rick Moen <rick-IyCrq+X4Fdq2oZ/[email protected]> wrote:

> Quoting Akkana Peck ([email protected]):
> > Rick Moen writes:
>
> > > and your gpg key database has all the information to do so
> > > automagically.
> >
> > ... that was the part that didn't work. And since it's supposed to
> > be automagic, nobody seemed to write about what to do if it didn't
> > work, or how to debug the process.
>
> I was being outrageously intellectually lazy when I said it's
> automagical.  Truthfully, I'd completely forgotten the messy details --
> and as I sit here, am groping fitfully to remember them, and idly
> Web searching for someone having done the heavy lifting, which finds me
> pages like https://wiki.gnupg.org/WebOfTrust .
>
> Obviously if Marc signed Ted's key at a keysigning party but you weren't
> even aware of the keysigning, you probably wouldn't easily come by
> Marc's digital signature.  IIRC (and this is where I try to reconstruct
> fading memory), Marc's signature might arrive at you because you
> received a mail purporting to be from Ted, and you seek out Ted's key
> from places including public keyservers.  Ted's key gets downloaded to
> your keyring, but also it gets accompanied by all digital signatures
> then on-record of Ted's key by others, including Marc's.  Your copy of
> gpg inscribes those digital signatures into your local gpg database
> along with the key.
>
> As mentioned on the above-cited Web page, your decisions for your local
> trustDB are also relevant, in deciding (based on your experience in
> keysigning parties and the like) the degree to which you trust
> 'introducers' of strangers' keys, e.g., you might at points in the past
> have decided you think Marc, me, Drew Strieb, or other relevant parties
> who claim to be able to attest to other people's keys (including
> possibly Ted's) are not wholly flaky peoople and their word can be
> relied upon.
>
> Now, in your case, I obviously don't have enough data to judge why this
> model didn't work out to vet a gpg signature's authenticity.  It would
> be flippant to say 'Attend more keysigning parties', but I fear that
> this probably would be the standard answer.  The whole web of trust
> model works best among reasonably well-connected people (such as the set
> of Debian developers) and outliers in the sense of 'I know a person who
> knows a person'.  The model shows design weaknesses if you expect it to
> reach arbitrary strangers.
>
> In that regard, someone asked about Keybase.io.  It does appear to be a
> third-party effort to expand the gpg web of trust's reach.  As I'm only
> now reading about it (except to say that I'm personally very _not_
> interested in social-networking services with murky business models who
> want to 'help' me).   I'll not say more except here's a novice explanation:
> https://snorre.io/gpg-web-of-trust-and-keybase-io/
>
>
>
> _______________________________________________
> svlug mailing list
> [email protected]
> http://lists.svlug.org/lists/listinfo/svlug
>


-- 
visit www.kcomputing.com for the best in Linux developer training.

_______________________________________________
svlug mailing list
[email protected]
http://lists.svlug.org/lists/listinfo/svlug