PGP Key Signing Party at UCITPS

As part of the UCSIRC charter, every member of UCSIRC is required
to use PGP for incident information sharing. In order for this to
work, a "web of trust" needs to be developed for the keys.

To start this "web of trust", you're all invited to a key signing
party to be held at next week's UCITPS meeting. Unfortunately,
refreshments will not be served and entertainment will be
limited to whatever sheer pleasure you derive from
having your public key vetted by your colleagues.

For this party to work, YOU need to do the following BEFORE
coming to the party:

        1) Generate a PGP/GPG key
        2) Upload your PUBLIC (not your private) key to a public
           key server.
        3) Print multiple (at least 20) copies of your public
           key fingerprint on small slips of paper with your name
           on them.
        4) Bring the slips of paper with you, along with a valid UC
           ID to the key signing party.

Ugh, you may be saying, what does all this mean? Well, here's some
additional information...

For a general overview, look here:
http://www.cryptnet.net/fdp/crypto/keysigning_party/en/keysigning_party.html

For PGP: http://www.pgp.com/index.html
PGP is the commercial version and comes with a nice GUI.

For GPG: http://www.gnupg.org
GPG is a GNU version of PGP and interoperates nicely.

Uploading Your Key
==================
There are numerous public key servers. Both PGP and GPG allow you
to upload your public key. You can also manually export your public
key and upload them to a public key server.

Here is a decent public key server to use:
        http://pgp.mit.edu/

You can use the pgp.mit.edu to look up my public key as an example.
Simply type in "Stephen.lau@ucsf.edu" in the search field. Select
verbose index and you will see that my key has been signed by
multiple people.

Printing Your Fingerprint
=========================
Key fingerprints are not the public keys. It's a block of 10
4 digit hexadecimal numbers. For example, my PGP fingerprint
is: "44C8 C9CB C15E 2AE1 7B0A 544E 9A04 AB2B F63F 748B" and can
always be found in my email signatures. They are used to
verify that the public key you have is the one you want.

Refer to your PGP client to determine how to extract the fingerprint
from your PGP key. Print the fingerprint along with your name
onto small strips of paper. These strips will be distributed to
other attendees so they can go and download your public key and verify
them by the fingerprints printed on the slips of paper.

Colleagues Who Can Not Attend
=============================
By the general guidelines for PGP web of trust building, one must
have face to face presence to vet each other's keys. If you
have colleagues who are not able to make it, you will not be allowed
to share their public keys in this venue. Since *you* know your
colleague, *you* can sign their keys and it will be up to individuals
if they wish to have transitive trust.

Feel free to ask any questions.

Steve

--
+---------------------------------------------------------------------
Stephen Lau - Stephen.Lau@ucsf.edu
Information Security Policy and Program Manager
University of California, San Francisco
1855 Folsom, Suite 602, Box 0707, San Francisco, CA 94143
+1(415) 476-3106 (Work) +1(415) 476-1717 (Fax)
PGP: 44C8 C9CB C15E 2AE1 7B0A 544E 9A04 AB2B F63F 748B
+---------------------------------------------------------------------