[Herts] Re: Key signing

[Steve Clark]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
We I should be there on Wednesday with some ID and some prints of my
key signature. We can always validate email addresses afterwards
before we actually sign keys. If we send each other signed/encrypted
messages and check the replies that should be enough unless someone
out there (Eve?) is intercepting the mails in some sort of "man in the
middle" attack.

See you there

- --
Steve

Andrew Benham wrote:

| Steve Clark wrote:
|
|> For the actual signing you just need to bring printouts of your
|> key signature and some form of identification e.g. passport or
|> photo driving licence. Those willing to sign your key can check
|> your identity and sign it at their leisure before re-uploading it
|>  to the keyservers. For the actual signing you just need to bring
|>  printouts of your key signature and some form of identification
|> e.g. passport or photo driving licence. Those willing to sign
|> your key can check your identity and sign it at their leisure
|> before re-uploading it to the keyservers.
|
| If there's going to be *useful* key-signing, please remember that
| one of the most useful pieces of data you're signing is the email
| address(es) in the key. For a fair amount of electronic
| communication, you may not care what is written on my birth
| certificate, just that you can be sure that you are still
| electronically communicating with the same 'me' as last month.
|
| I work for a well-known UK ISP. We won't sign a key without, after
|  other identity checks, we can prove to ourselves that we can send
| a secret to the email address in the key, encrypted with that key;
| and receive the secret back in an email reply, signed with that
| key, from that email address.
|
| Otherwise I can turn up with my passport, driving licence, Tufty
| Club membership certificate, etc. and have you sign the key for a
| different Andrew Benham.
|

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)
Comment: Public key at www.bagofspoons.net/publickey or on the keyservers
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
 
iD8DBQFCCMFANkxgfhTlqU4RAtJzAJ96jMbO4t9u9Tb5BHomrPIaICvw+QCfcXyE
XD9l0/5v23tvlbl/NO5kn48=
=K1ph
-----END PGP SIGNATURE-----