Re: PGP keysigning at LPC/OSSE 2026

[Krzysztof Kozlowski]

On 05/08/2026 12:29, Uwe Kleine-König wrote:
> Hello Krzysztof,
> 
> On Wed, Aug 05, 2026 at 08:32:22AM +0200, Krzysztof Kozlowski wrote:
>> While as much as I like key signing, I do not believe in
>> Zimmermann–Sassaman protocol to work, because of people's negligence. It
>> requires the participants to check if THEIR key is correct, but based on
>> my recent practice (people generated new key and week later they lost
>> password to it; people received my signed keys and could not decrypt the
>> message because they never used encrypted email, people sent me emails
>> asking to send their keys) I think it has significant risk of this not
>> happening. People just do not understand the security principles here
>> thus they do not think certain steps are an absolute requirement.
> 
> I see your point. However if Bob confirms his fingerprint on the
> Zimmermann–Sassaman list is right while he didn't actually checked and
> as an effect a forged certificate is signed, that's mostly Bob's
> problem.
> 
> Also if Bob doesn't check his own fingerprint, he probably also doesn't
> check the certificates he signs carefully and thus his signatures
> shouldn't be trusted.
> 
> That's why a keysigning is about a *web* of trust where the (little?)
> trust in each individual path between me and a given other person sums
> up.

I am rather thinking of someone planting their key in place of the
person's one, thus of course Bob will have a problem, but bigger problem
is that I would sign malicious actor's key.

> 
>> IOW, I do not believe people will check their key fingerprints and email
>> IDs, they will gladly accept what you prepared on the server and that
>> could have been modified by an attacker or mischievous actor wanting to
>> prank us.
>>
>> That's why I require that the keys to be given to me must be prepared by
>> that owner, not by a third party. I have some proofs that at least that
>> key was in the possession of the owner, when he was preparing it. I will
>> be happy to sign keys of developers given to me that way.
> 
> Last time I talked to Greg about these paper slips, he had trouble
> finding gpg-key2ps on Arch and I prepared the postscript file for him :-D

1. gpg --fingerprint your-name
2. Paste it to a TXT file without the "sub" parts
3. Copy+paste to fill up the page
4. Print and cut

No need for gpg-key2ps.


> 
>> I know that you want to speed it up, but honestly korg keysigning should
>> not have that many participants, so exchanging key slips should be fine
>> as I was doing in the past.
> 
> I think even if we're only 10 in the end, the speedup is noticeable. And
> it also simplifies the actual signing process for everyone, as I will
> provide a keyring of all the handed in certificates.

And now I have one more doubt because Bob, who I did not trust that he
understands security principles of key signing (see my previous email
why), might not verify that keys in above keyring are the ones from the
paper. IOW, Bob will happily sign whatever you send him, to speed things
up. Otherwise there is no speed up comparing to:

$ gpg --recv-key <here goes keyID, which one has to manually type, thus
it is 100% verified>

> 
> If you still want a paper slip from each participant before being ok to
> sign their certificate, that's fine. I'm still convinced that preparing
> the Zimmermann–Sassaman list is a net win. And you're welcome to
> participate no matter if your cert is on the list or not.



Best regards,
Krzysztof