Re: [72attendees] PGP keysigning procedure

--On Wednesday, July 30, 2008 05:03:10 PM +0300 Zoltan.Ordogh@nokia.com 
wrote:

> I was wondering what it is, too.

I'm pretty sure Janos was asking for information about the specific 
procedures we would use, rather than the more general "what is it".  Since 
he managed to send in his key in time and showed up at the session, I 
presume he got the information needed.

The key-signing is nothing more or less than an opportunity to get together 
with other people who also have PGP keys for the purpose of signing each 
other's keys.  Key signatures are the basis of PGP's web-of-trust model; 
they are an assertion by the signer that the signed key actually belongs to 
a particular person.

> From the invitation I understood it goes on paper. For some reason which
> I do not quite understand (we should be preserving the environment
> instead of chopping wood for such reason).

The parallel fingerprint verification scheme we use works best if, instead 
of having to manually record each 160-bit fingerprint, participants start 
with a list of fingerprints and merely have to verify that they are 
correct.  Traditionally, that list is distributed both online and on paper; 
many people prefer the paper form for various reasons.  Personally, I find 
that my on-paper notes about which fingerprints are valid are much harder 
for a remote attacker to modify than an electronic version would be. 
Others may show up to the session without a laptop; hard as it is to 
believe, some IETF attendees still do not bring laptops.

> The thing is that 'they' never provide proper description in the
> invitation, so I guess it's a private club for those who know, or those
> who dare.

I'm sorry you feel that way.  It's certainly not a private club; key 
signings are open to anyone who wants to participate.  However, I've 
basically assumed (as did Ted Ts'o, when he was running these) that the 
only people who will want to participate are those who have or are thinking 
about generating PGP keys, and that for _those_ people, the phrase "PGP key 
signing party" is sufficient description, and the rest of the invitation 
enough detail to successfully participate.  Perhaps that assumption is 
invalid; if so, please let me know what the invitation could have said that 
would make it clearer what is going on.

> My - probably non-sense - guess is that it works like a lottery; you pick
> someone's name from Santa's hat and you get to sign a message together.

Not at all -- we use a procedure designed to scale linearly for even a 
large number of participants, while allowing everyone to potentially get a 
signature from everyone else.  No hats are involved.

-- Jeffrey T. Hutzelman (N3NHS) <jhutz+@cmu.edu>
   Carnegie Mellon University - Pittsburgh, PA

_______________________________________________
72attendees mailing list
72attendees@ietf.org
https://www.ietf.org/mailman/listinfo/72attendees