PGP keysigning party instructions

Updated: Maybe you should not generate a key with the default settings. See Step 1 below.

The September 2010 meeting will feature a keysigning party.

Chris Frey (cdfrey at the domain foursquare dot net) is the KeyMaster for this party. As part of the process, you will e-mail him your key.

Here are his instructions for getting started, with some e-mail address obfuscation:

  1. Generate new key:

    gpg --gen-key

    (Accept the defaults, they are pretty good)

    Update: Denver Gingerich notes that one of the algorithms used in the defaults (SHA-1) has vulnerabilities. Although these vulnerabilities have not resulted in exploits yet, if you are generating a new key you may want to use less vulnerable settings. Denver suggests:

    • Generate an RSA key
    • Make it 4096 bits long
  2. Look at your shiny new key:

    gpg --list-keys

  3. Export it to a file:

    gpg --armor --output /tmp/my-public-key --export

    Replace ID with the first ID of your key. For example,
    my key looks like this in the --list-keys display:

    pub 1024D/DC6371D5 2006-12-02 [expires: 2011-12-01]
    uid Chris Frey (cube)
    sub 4096g/C2855553 2006-12-02 [expires: 2011-12-01]

    So my ID is DC6371D5.

  4. Email the file my-public-key to me. (i.e. to Chris)
  5. Show up on September 13, with your fingerprint printed out on a sheet of paper, and ready to read it out loud.

    gpg --fingerprint


    gpg --fingerprint dc6371d5
    pub 1024D/DC6371D5 2006-12-02 [expires: 2011-12-01]
    Key fingerprint = 7D71 47F2 3F61 B0E1 5F3C 68A4 819A 39D8 DC63 71D5
    uid Chris Frey (cube)
    sub 4096g/C2855553 2006-12-02 [expires: 2011-12-01]

At the meeting you will have to read your fingerprint and have others vouch for your identity. Some people do this via government ID; other people think this is not sufficient.