BSDCan Banner
Home
Call for papers
Papers
Committee
Presentations
Speakers
Registration
Tutorials
Schedule
Sponsors

Social
BOFs

Where?

University of Ottawa
(Room Number to be determined)
Ottawa, Ontario, CANADA

When?

Saturday, May 15, 2004
16:30 - 17:30

The 'party' will start immediately after the 4:30pm "All Conference Assembly" and go until about 5:30. Feel free to start gathering a little earlier to discuss the merits of PGP, or BSD, or the latest weather reports. :)

Who?

Web of Trust Graph This key signing party is for anyone attending the BSDCan conference. People not attending the BSDCan conference are also welcome to participate.

The current table of attendees is here, and you can view the BSDCan Web of Trust by clicking on the graphic. Matthew Wilcox has done an even more interesting analysis too.

Also, Click here to download the keyring.

What's a key-signing party?

A key-signing party is a get-together with PGP users for the purpose of meeting other PGP users and signing each other's keys. This helps to extend the "web of trust" to a great degree. Also, it sometimes serves as a forum to discuss strong cryptography and related issues.

What do I need for this party?

Required Items
  1. Physical attendance
  2. Positive picture ID. A passport is recommended, but individuals may accept other forms of ID such as driver's licenses, health cards, etc. If in doubt, bring as much ID as possible.
  3. Your Key ID, Key type, HEX fingerprint, and Key size
  4. A pen/pencil or whatever you'd like to write with....
  5. NO computer

Required Process
  1. Generate a key/Remember your pass phrase
  2. All attendees send their public keys to a public keyserver. I personally use subkeys.pgp.net, but any major synchronized server should be fine.
  3. All attendees send their key ID, key type, fingerprint, and key size to the host, keys@bsdcan.org, who will compile everyone's key information. Please submit your key by May 14th.
    The best way to do this is to send the output of "gpg --fingerprint my_email@address.ca". It will look something like this:
      pub  1024D/D77B43FB 2002-06-05 Victor Gedris 
           Key fingerprint = 04A9 75C4 36A3 9925 9606  3F5A 4945 A537 D77B 43FB
      sub  2048g/CFF14C4D 2002-06-05
      
  4. The host prints a list with everyone's key ID, key type, fingerprint, and key size from the compiled keyrings and distributes copies of the printout at the meeting.
  5. Attend the party. Bring along a paper copy of your key ID, key type, fingerprint, and key size that you obtained from your own keyring. You must also bring along a suitable photo ID. Instruct the attendees at the beginning that they are to make two marks on the listing, one for correct key information (key ID, key type, fingerprint, and key size) and one if the ID check is ok.
  6. At the meeting each key owner reads his key ID, key type, fingerprint, key size, and user ID from his own printout, not from the distributed listing. This is because there could be an error, intended or not, on the listing. This is also the time to tell which ID's to sign or not. If the key information matches your printout then place a check-mark by the key.
  7. After everyone has read his key ID information, have all attendees form a line.
  8. The first person walks down the line having every person check his ID.
  9. The second person follows immediately behind the first person and so on.
  10. If you are satisfied that the person is who they say they are, and that the key on the printout is theirs, you place another check-mark next to their key on your printout.
  11. Once the first person cycles back around to the front of the line he has checked all the other IDs and his ID has been checked by all others.
  12. After everybody has identified himself or herself the formal part of the meeting is over. You are free to leave or to stay and discuss matters of PGP and privacy (or anything else) with fellow PGP users. If everyone is punctual the formal part of the evening should take less than an hour.
  13. After confirming that the key information on the key server matches the printout that you have checked, sign the appropriate keys. Keys can only be signed if they have two check-marks.
  14. Send the signed keys back to the keyservers.
  15. Use those keys as often as possible.

Why shouldn't I bring a computer?

There are a variety of reasons, why you don't want to do this. The short answer is it would be insecure, unsafe, and of no benefit. For those not convinced, here are some reasons why it is insecure, unsafe, and of no benefit.

  • Someone might have modified the computers programs, operating system, or hardware to steal or modify keys.
  • If people are swapping disks with their keys on them the computer owner has to worry about viruses.
  • If people are carrying their secret keys with them and intend to do the signing at the actual meeting by typing their passphrase into a computer, then they are open to key-logging attacks, shoulder-surfing, etc.
  • It is much better to just exchange key details and verify ID and then do the signing when you get home to your own trusted computer.
  • Someone might spill beer on it.
  • Someone might drop it or knock it off the table.
  • More reasons, I don't feel like articulating

Other questions about signing keys?

You may want to read the Keysigning Party Howto which includes an explanation of the concepts behind keysigning, instructions for hosting a keysigning party, instructions for participating in a keysinging party, and step by step instructions for signing other's keys.

Other useful PGP links

A few more links for PGP newbies, or those who wish to re acquaint themselves.

What if I still have a question?

If you'd like some help answering it, you can contact the event coordinators, via email at keys@bsdcan.org.

Hotel + Travel
About Ottawa
FAQ

Links
Help out!
Contact Us
News
Privacy
What is BSD?

BSDCan 2004
BSDCan 2005
BSDCan 2006
BSDCan 2007
BSDCan 2008
BSDCan 2009
BSDCan 2010
BSDCan 2011
BSDCan 2012
BSDCan 2013
BSDCan 2014
BSDCan 2015
BSDCan 2016
BSDCan 2017
Copyright © 2003-2011 BSDCan. All rights reserved.
Valid HTML, and CSS