re: [local] Report on Portland Cpunks meeting

>There was a key signing.  It was a bit rough as for many of us it was our
>first key signing.  (I think Neal was the only person who had been to an
>organized key signing.)  Still, it went fairly well.  Only a couple of
>people brought their key fingerprints on disk instead of paper.  As of
>today, I have only recieved signed keys back from a couple of people
>though...  The next key signing will be done a bit differently.  (Live and
>learn.)  There was also a suggestion for a nym signing at some point.

This begs the question, "How would you conduct an efficient key signing 
given what you have learned?" I am in the process of organizing one and 
would like to get input as to the best way that this should take place.  
Should people bring key fingerprints and public keys on floppy?  Would it 
be nice to be online and grab public keys off of a key server? How would 
you conduct a nym signing?

      Weld Pond   -  weld@l0pht.com      -     http://www.l0pht.com/
      L  0  p  h  t    H  e  a  v  y    I  n  d  u  s  t  r  i  e  s          
      Technical archives for the people  -  Bio/Electro/Crypto/Radio

Weld Pond writes:
> This begs the question, "How would you conduct an efficient key signing 
> given what you have learned?" I am in the process of organizing one and 
> would like to get input as to the best way that this should take place.  

The IETF key signing parties are the largest in existance -- about 100
people exchange signatures.

The way you handle it is this:

Every person's key is pre-submitted to key signing party organizer,
who prints a list of names and fingerprints on paper and xeroxes
enough for everyone attending.

Each person gets a sheet. Either each person in the room reads their
fingerprint in turn from their own copy, with each person in the room
checking the read fingerprint against the fingerprint on the handout,
or an appointed reader (or set of readers at the last IETF) read the
fingerprints in turn and ask the owner of the key to then simply say
"yes" or "its mine" or whatever to verify that the fingerprint matches
their own copy of the print.

Afterwards, each person will have a sheet with checkmarks next to
every fingerprint they think really belongs to a particular person's
key. They then go off later on, download the keyring for the party
from sonewhere, and sign everything they want to sign and mail back
the signed keys to the party organizer.

This is about the only way to handle things -- it turns the N squared
problem into an O(N) problem, which is still very bad if there are
more than about twenty people around.

Perry

-----BEGIN PGP SIGNED MESSAGE-----

In list.cypherpunks, weld@l0pht.com writes:

> This begs the question, "How would you conduct an efficient key signing 
> given what you have learned?" I am in the process of organizing one and 
> would like to get input as to the best way that this should take place.  
> Should people bring key fingerprints and public keys on floppy?

Fingerprints, yes.  Floppies, perhaps not.  At the least, it means you
have to have hardware on site and someone has to work swapping floppies.

I've done a signing where we all send out keys to one person.  He
distributes a keyring to all participants. Then we meet, exchange
fingerprints in person, take the prints home and sign in private.
All the participants mail their keys back to the collector, who
returns a keyring with all keys, properly signed.  I always hand out my
Certified Computer Geek[tm] card, which has only email addresses, web
page and key fingerprints.

> How would you conduct a nym signing?

I suppose that depends on whether you want to associate a nym with a
physical person.
- -- 
           Roy M. Silvernail     [ ]      roy@cybrspc.mn.org
PGP Public Key fingerprint =  31 86 EC B9 DB 76 A7 54  13 0B 6A 6B CC 09 18 B6
                Key available from pubkey@cybrspc.mn.org

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMQWNrBvikii9febJAQE5CgQAliDvBcJze7XbW8k1EOPEZYmq69jUDPu/
6W9wqJ9m9nuNHVK1C3m+rW+F6fMQ9gvGbiMM9+ljlSSJzgS+Pj8j7hTIy3rjXsdO
G6di+s62V8hawtPLeknrT9vXRCJmAdsb7rodYjc7zmQUKLUYz+e657o/tomYICDZ
s0c6lniwpUs=
=LUpN
-----END PGP SIGNATURE-----