Validating SuSE PGP keys for security announcements
Good day, all I finally got around to installing and learning GPG on my system. Not that I'm apathetic about security; just that until now I've followed the practice of never e-mailing anything sensitive. I decided it was time to get this up and running just in case I ever need to do so. I was able to extract the SuSE key from an announcement on this list, and to add it to my GPG keyring. SuSE's messages now say that the signature is valid but that the key cannot be verified. So my question: How do I trace back the SuSE key to a signer, so that I can decide how far back I need to go in order to get one that I trust? I'm less concerned about this for the specific case of the SuSE announcements, which I can verify on their web site, than in the general case. Without going to a key signing party, are there other ways I can get my own GPG keys signed without violating the web-of-trust model? I'm familiar with how public key cryptography works and the implications of the web-of-trust versus central-authority models. I'm asking about specific mechanics of the "getting people together" problem, with regard to how it works in the Open Source community, rather than about concepts of the technology itself. Thanks for any suggestions. Kind regards, Scott -- -----------------------+------------------------------------------------------ Scott Courtney | "I don't mind Microsoft making money. I mind them courtney@4th.com | having a bad operating system." -- Linus Torvalds http://4th.com/ | ("The Rebel Code," NY Times, 21 February 1999) | PGP Public Key at http://4th.com/keys/courtney.pubkey
On Tue, 02 Jul 2002, Scott Courtney wrote:
I was able to extract the SuSE key from an announcement on this list, and to add it to my GPG keyring. SuSE's messages now say that the signature is valid but that the key cannot be verified.
So my question: How do I trace back the SuSE key to a signer, so that I can decide how far back I need to go in order to get one that I trust? I'm less
Two steps for each key 1. Get a copy of the key fingerprint from a separate channel that you trust (such as the printed "Security" manual from SuSE) and compare it with the fingerprint of your copy of the key 2. Sign the copy of the SuSE key that is on your keyring. Actually there are two keys you are probably interested in. Security announcements security@suse.de Package signing build@suse.de The build key comes on your CD so I guess many people trust it without verifying the fingerprint. (You need some way to get a trusted copy of GPG :-) )
I'm familiar with how public key cryptography works and the implications of the web-of-trust versus central-authority models. I'm asking about specific mechanics of the "getting people together" problem, with regard to how it works in the Open Source community, rather than about concepts of the technology itself.
You don't really need to meet someone in the web of trust to verify your suse keys for your personal use. Some Linux and Unix user groups have GPG key signing events, after their meetings or at conferences. Ask UGs in your area. dproc
* dproc@dol.net wrote on Wed, Jul 03, 2002 at 10:41 -0500:
On Tue, 02 Jul 2002, Scott Courtney wrote:
I was able to extract the SuSE key from an announcement on this list, and to add it to my GPG keyring. SuSE's messages now say that the signature is valid but that the key cannot be verified.
Isn't the SuSE key on the CDs, somewhere?
2. Sign the copy of the SuSE key that is on your keyring.
Well, but IIRC gpg asks in that case: "are you sure by your first hand knowledge" - and here this is not the case. Isn't there an other possibility that signing? In that case, I would use some dummy sign key I guess. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.
On Friday 05 July 2002 05:03 am, Steffen Dettmer wrote:
On Tue, 02 Jul 2002, Scott Courtney wrote:
I was able to extract the SuSE key from an announcement on this list, and to > add it to my GPG keyring. SuSE's messages now say that the signature is valid > but that the key cannot be verified.
Isn't the SuSE key on the CDs, somewhere?
Yes, it is. I hadn't realized that, but someone was kind enough to e-mail me privately to let me know. Scott (Who is feeling very embarrassed just now...) -- -----------------------+------------------------------------------------------ Scott Courtney | "I don't mind Microsoft making money. I mind them courtney@4th.com | having a bad operating system." -- Linus Torvalds http://4th.com/ | ("The Rebel Code," NY Times, 21 February 1999) | PGP Public Key at http://4th.com/keys/courtney.pubkey
participants (3)
-
dproc＠dol.net -
Scott Courtney -
Steffen Dettmer