On Saturday 05 February 2005 10:06, Joe Abley wrote:
2. For each person whose identified you are satisfied with, check the fingerprint on the downloaded keyring against the sheet of verified fingerprints.
3. If you feel like it, sign the key with yours. This is a convenient way to record the fact that you have verified the accuracy of the key.
So from the key signing party we should be in the position that for anyone we have verified we are happy that the pgp key we have the fingerprint for is indeed for the person we met but the one thing that the process hasn't done is confirm that all the email addresses listed in the key are under the control of that person. To achieve this last step here is a process (lifted from the NetBSD developers PGP guidelines): 6. The remaining task prior to signing is to determine whether the other party has control over the e-mails given in all uids. To check this, generate a random number and send this number, encrypted with his key, to the other party. The task of the other party is to encrypt the random number and send it back, this time encrypted with your public key (the requirement for the encrypted return channel is to spoil any crypto-analysis attacks). If you're checking multiple uids for one PGP key, keep track of which random number you send to which e-mail address. Here is an example of step 6 using gnupg: % cat >> moe(a)doe.org Hi Moe, please return this message to me. Please sign and encrypt it. Thanks, Joe ^D % dd if=/dev/urandom count=1 | md5 >> moe(a)doe.org % gpg --armor --encrypt moe(a)doe.org > moe(a)doe.org.asc 7. Once you've received his reply, decrypt it and check his signature. If that is successful, that concludes the necessary tests and you can signs his public key. So those of you at the Key Signing party can expect to see one (or several) of these messages from me in the near future. cheers mark