Signing PGP keys
Sat 21 June 2014
If you've recently completed a key signing party or have otherwise met up with other people and have exchanged key fingerprints and verified IDs, it's now time to sign the keys you trust. There are several different ways of completing this task and I'll discuss two of them now.
caff
CA Fire and Forget (caff) is a program that allows you to sign a bunch of keys (like you might have after a key signing party) very quickly. It also adds a level of security to the signing process by forcing the other person to verify that they have both control over the email address provided and the key you signed. The way caff does this is by encrypting the signature in an email and sending it to the person. The person who receives the message must also decrypt the message and apply the signature themselves. Once they sync their key with the key server the new signatures will appear for everyone.
$ gpg --keyserver hkp://pool.sks-keyservers.net --refresh-key
There is some setup of caff that needs to be done prior but once you have it setup it'll be good to go.
Installing caff
Installing caff is pretty easy although there might be a little trick. In Fedora there isn't a caff package. Caff is actually in the pgp-tools package; other distros may have this named differently.
Using caff
Once you have caff installed and setup, you just need to tell caff what key IDs you would like to sign. "man caff" will give you all the options but basically 'caff -m [STRIKEOUT:no] yes -u ' will sign all the keys listed after your key. You will be asked to verify that you do want to sign the key and then caff will sign the key and mail it off. The user will receive an email, per user id on the key, with instructions on importing the signature.
Signing a key with GnuPG
The other way of signing a PGP key is to use GnuPG. Signing a key this way will simply add the signature to the key you have locally and then you'll need to send those keys out to the key server.
Retrieving keys using GnuPG
The first thing that you have to do is pull the keys down from the keyserver.
$ gpg --keyserver hkp://pool.sks-keyservers.net --recv-keys ...
Once you have received all the keys you can then sign them. If someone's key is not there you should probably contact them and ask them to add their key to the servers. If they already have uploaded their key, it might take a couple of hours before it is sync'd everywhere.
Using GnuPG
Signing a key is pretty straightforward:
$ gpg --sign-key 1bb943db pub 1024D/1BB943DB created: 2010-02-02 expires: never usage: SC trust: unknown validity: unknown sub 4096g/672557E6 created: 2010-02-02 expires: never usage: E [ unknown] (1). MariaDB Package Signing Key <package-signing-key@mariadb.org> [ unknown] (2) Daniel Bartholomew (Monty Program signing key) <dbart@askmonty.org> Really sign all user IDs? (y/N) y pub 1024D/1BB943DB created: 2010-02-02 expires: never usage: SC trust: unknown validity: unknown Primary key fingerprint: 1993 69E5 404B D5FC 7D2F E43B CBCB 082A 1BB9 43DB MariaDB Package Signing Key <package-signing-key@mariadb.org> Daniel Bartholomew (Monty Program signing key) <dbart@askmonty.org> Are you sure that you want to sign this key with your key "Eric Harlan Christensen <eric@christensenplace.us>" (024BB3D1) Really sign? (y/N) y
In the example I signed the MariaDB key with my key. Once that is complete a simple:
gpg --keyserver hkp://pool.sks-keyservers.net --send-key 1BB943DB
...will send the new signature to the key servers.